Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
32534 vulnerabilities found for linux by linux
CVE-2026-90049 (GCVE-0-2026-90049)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:42
VLAI
EPSS
VEX
Title
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the copy helper does not own. That completes
@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the
SKBFL_SHARED_FRAG page-ownership marker.
Both callers already report the failure on their own drop path.
nfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in
the flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by
dropping it here.
On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on
this error: do_execute_actions() ignores output_userspace()'s return
value and, unless the upcall was the last action, keeps forwarding the
same skb through the flow's remaining actions. The uarg is completed
while that skb is still in flight, telling the producer its buffers are
free, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack
still handles. That flag is what makes esp_input() call skb_cow_data()
instead of decrypting in place, so a later local ESP delivery can
decrypt over frags the skb does not own privately.
Leave error reporting to the callers.
Severity
9.3 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
36d5fe6a000790f56039afe26834265db0a3ad4c , < 849bdb83123760a865bcb2970127f4c0b9423ba3
(git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < fb10e0e9b220a2eed08931a60dbaad9a2370c908 (git) Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 767ec2a65cc022d303b0c9c12811e7db22057341 (git) Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 8069643ae64dfdf634b6c78c7f622e5323031436 (git) Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 04dd250a78e268af3e7124beb1dc10ec1dd88d60 (git) Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < a13b1e80e5015cd732440b475c0ef443dc4a2157 (git) Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < bab5a851e44a3601d31f2aa8043f385bb50ac5d9 (git) Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 8ece906150128d5ec2462aabcc978c568433eca4 (git) Affected: c5f0c0e7525443add533495e93ba8de6feab2396 (git) Affected: 1674b4bf3eea3cac51b70778e89f8025f7cfe695 (git) Affected: 3.10.51 , < 3.11 (semver) Affected: 3.12.40 , < 3.13 (semver) |
|
| Linux | Linux |
Affected:
3.14
Unaffected: 0 , < 3.14 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "849bdb83123760a865bcb2970127f4c0b9423ba3",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"lessThan": "fb10e0e9b220a2eed08931a60dbaad9a2370c908",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"lessThan": "767ec2a65cc022d303b0c9c12811e7db22057341",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"lessThan": "8069643ae64dfdf634b6c78c7f622e5323031436",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"lessThan": "04dd250a78e268af3e7124beb1dc10ec1dd88d60",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"lessThan": "a13b1e80e5015cd732440b475c0ef443dc4a2157",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"lessThan": "bab5a851e44a3601d31f2aa8043f385bb50ac5d9",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"lessThan": "8ece906150128d5ec2462aabcc978c568433eca4",
"status": "affected",
"version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
"versionType": "git"
},
{
"status": "affected",
"version": "c5f0c0e7525443add533495e93ba8de6feab2396",
"versionType": "git"
},
{
"status": "affected",
"version": "1674b4bf3eea3cac51b70778e89f8025f7cfe695",
"versionType": "git"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.51",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.40",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don\u0027t skb_tx_error() the source skb in skb_zerocopy()\n\nskb_zerocopy() copies frags from @from into @to. On an\nskb_orphan_frags() failure it calls skb_tx_error(@from), a destructive\noperation on the source skb the copy helper does not own. That completes\n@from\u0027s zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the\nSKBFL_SHARED_FRAG page-ownership marker.\n\nBoth callers already report the failure on their own drop path.\nnfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in\nthe flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by\ndropping it here.\n\nOn Open vSwitch\u0027s OVS_ACTION_ATTR_USERSPACE path the skb is not freed on\nthis error: do_execute_actions() ignores output_userspace()\u0027s return\nvalue and, unless the upcall was the last action, keeps forwarding the\nsame skb through the flow\u0027s remaining actions. The uarg is completed\nwhile that skb is still in flight, telling the producer its buffers are\nfree, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack\nstill handles. That flag is what makes esp_input() call skb_cow_data()\ninstead of decrypting in place, so a later local ESP delivery can\ndecrypt over frags the skb does not own privately.\n\nLeave error reporting to the callers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - skb_zerocopy() only skb_tx_error()s the source when skb_orphan_frags() fails, which requires a still-attached zerocopy uarg without SKBFL_DONT_ORPHAN (vhost-net, xen-netback, AF_PACKET mmap); ordinary remote NIC packets never carry that uarg.\nAC:L - The attacker drives zerocopy TX and can fail skb_copy_ubufs() without an uncontrolled race (non-last OVS OUTPUT clones the skb so skb_shared() is set, or induced GFP_ATOMIC pressure); do_execute_actions() ignores the USERSPACE error and keeps forwarding.\nPR:N - A KVM/Xen guest using vhost-net or xen-netback needs no host account, capability, or /dev/vhost-net fd\u2014only virtio/netback TX on the provisioned vNIC.\nUI:N - Guest or local zerocopy TX and in-kernel OVS USERSPACE-then-forward processing run without the victim mounting, opening a file, or otherwise interacting.\nS:C - vhost-net and xen-netback are host/Dom0 kernel code on the guest NIC boundary; premature uarg completion and SKBFL_SHARED_FRAG removal run in host context from guest zerocopy TX, impacting host kernel state outside the guest authority.\nC:H - skb_tx_error() completes the uarg while the skb is still forwarded and clears SKBFL_SHARED_FRAG, so later esp_input() skips skb_cow_data() and decrypts in place over producer-reused frags, a UAF/in-place primitive that can disclose host-held page contents.\nI:H - In-place ESP decrypt over frags the skb does not own privately, plus premature zerocopy completion, writes attacker-influenced data into pages still referenced by the in-flight host skb, a write primitive suitable for integrity compromise and control-flow impact.\nA:H - Reuse of zerocopy pages still referenced by the forwarded skb, and in-place overwrites of those pages, cause host oopses and panics that can be retriggered from guest or local TX until the host is unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:42:05.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/849bdb83123760a865bcb2970127f4c0b9423ba3"
},
{
"url": "https://git.kernel.org/stable/c/fb10e0e9b220a2eed08931a60dbaad9a2370c908"
},
{
"url": "https://git.kernel.org/stable/c/767ec2a65cc022d303b0c9c12811e7db22057341"
},
{
"url": "https://git.kernel.org/stable/c/8069643ae64dfdf634b6c78c7f622e5323031436"
},
{
"url": "https://git.kernel.org/stable/c/04dd250a78e268af3e7124beb1dc10ec1dd88d60"
},
{
"url": "https://git.kernel.org/stable/c/a13b1e80e5015cd732440b475c0ef443dc4a2157"
},
{
"url": "https://git.kernel.org/stable/c/bab5a851e44a3601d31f2aa8043f385bb50ac5d9"
},
{
"url": "https://git.kernel.org/stable/c/8ece906150128d5ec2462aabcc978c568433eca4"
}
],
"title": "net: skbuff: don\u0027t skb_tx_error() the source skb in skb_zerocopy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90049",
"datePublished": "2026-09-16T10:33:45.259Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:42:05.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90048 (GCVE-0-2026-90048)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:42
VLAI
EPSS
VEX
Title
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)
(== record_size) bytes and then walks every attribute of the primary MFT
record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor
by le_size(name_len), with no check against the end of the buffer; the
total size is only computed after the loop.
A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)
bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)
bytes in the list. Because the number of attributes in a record is not
bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless
minimum-size attributes), a crafted record packed with such attributes
produces a list larger than record_size and overflows the heap buffer.
This is reachable from a crafted, loop-mounted NTFS image: opening the file
and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() ->
ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() ->
ni_create_attr_list().
BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058
Write of size 4 at addr ffff000008984c00 by task setfattr/345
ni_create_attr_list+0xc48/0x1058
ni_ins_attr_ext+0x510/0x7c0
ni_insert_attr+0x3f8/0x70c
ni_insert_resident+0xc8/0x3b0
ntfs_set_ea+0x66c/0xd28
ntfs_setxattr+0x4d8/0x5b0
__arm64_sys_setxattr+0xa4/0x124
Allocated by task 345:
ni_create_attr_list+0x188/0x1058
The buggy address belongs to the cache kmalloc-1k of size 1024
(the write lands at object+1024).
Size the buffer from the actual attributes instead of assuming a single
record_size is always enough.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 7e9aee7e4d9767cc3e423b3beecb01c7ebb6bbcd
(git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < fa2215cf451414b0512cd6f7d37a057893811f4d (git) Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < d07e281f2a7710502985d6f80b95ddac8f4e81d5 (git) Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < a84f3db72561c4d9281c5ff721ce46b9ffa7f30e (git) Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 7c4841e2a62794a3bab7c1ff0540580f387e377f (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/frecord.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e9aee7e4d9767cc3e423b3beecb01c7ebb6bbcd",
"status": "affected",
"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
"versionType": "git"
},
{
"lessThan": "fa2215cf451414b0512cd6f7d37a057893811f4d",
"status": "affected",
"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
"versionType": "git"
},
{
"lessThan": "d07e281f2a7710502985d6f80b95ddac8f4e81d5",
"status": "affected",
"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
"versionType": "git"
},
{
"lessThan": "a84f3db72561c4d9281c5ff721ce46b9ffa7f30e",
"status": "affected",
"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
"versionType": "git"
},
{
"lessThan": "7c4841e2a62794a3bab7c1ff0540580f387e377f",
"status": "affected",
"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/frecord.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()\n\nni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)\n(== record_size) bytes and then walks every attribute of the primary MFT\nrecord, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor\nby le_size(name_len), with no check against the end of the buffer; the\ntotal size is only computed after the loop.\n\nA minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)\nbytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)\nbytes in the list. Because the number of attributes in a record is not\nbounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless\nminimum-size attributes), a crafted record packed with such attributes\nproduces a list larger than record_size and overflows the heap buffer.\n\nThis is reachable from a crafted, loop-mounted NTFS image: opening the file\nand adding an attribute (e.g. via setxattr) drives ntfs_set_ea() -\u003e\nni_insert_resident() -\u003e ni_insert_attr() -\u003e ni_ins_attr_ext() -\u003e\nni_create_attr_list().\n\n BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058\n Write of size 4 at addr ffff000008984c00 by task setfattr/345\n ni_create_attr_list+0xc48/0x1058\n ni_ins_attr_ext+0x510/0x7c0\n ni_insert_attr+0x3f8/0x70c\n ni_insert_resident+0xc8/0x3b0\n ntfs_set_ea+0x66c/0xd28\n ntfs_setxattr+0x4d8/0x5b0\n __arm64_sys_setxattr+0xa4/0x124\n Allocated by task 345:\n ni_create_attr_list+0x188/0x1058\n The buggy address belongs to the cache kmalloc-1k of size 1024\n (the write lands at object+1024).\n\nSize the buffer from the actual attributes instead of assuming a single\nrecord_size is always enough."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ntfs3 registers export_operations, so ksmbd/nfsd VFS write and setxattr on an exported NTFS volume reach ni_create_attr_list() via ntfs_set_size/attr_set_size_ex and ntfs_setxattr\u2192ni_insert_resident\u2192ni_ins_attr_ext; NAS/router SMB sharing of USB NTFS is a reasonable high-impact path.\nAC:L - The attacker fully controls a primary MFT record packed with unnamed SIZEOF_RESIDENT attributes, so the ATTR_LIST_ENTRY walk overflows the fixed kzalloc(record_size) buffer on the first attribute insert or allocation extend; no race or attacker-uncontrollable layout is required.\nPR:N - Triggering needs only write or setxattr permission on the crafted file, including guest/anonymous SMB or a permissive NFS export; no local account, init-namespace root, or CAP_SYS_ADMIN is required on the trigger path.\nUI:N - Once the crafted NTFS volume is mounted and exported, or automounted from removable/shared storage, the attacker triggers the overflow with an ordinary write, truncate, or setxattr; no extra victim clicks, prompts, or confirmation are required.\nS:U - The slab out-of-bounds write corrupts kernel heap in the same host OS security authority as ntfs3; it can enable privilege escalation but does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The overflow writes attacker-controlled ATTR_LIST_ENTRY fields (type, name, id) past the kmalloc-1k object into adjacent slab, a heap-corruption primitive that can be leveraged for kernel memory disclosure.\nI:H - The unbounded ATTR_LIST_ENTRY walk is a slab out-of-bounds write of attacker-influenced attribute metadata into adjacent heap objects, enabling arbitrary kernel writes and potential control-flow hijack.\nA:H - KASAN reports a slab-out-of-bounds write in ni_create_attr_list(); overflowing the kmalloc object corrupts adjacent heap and causes a kernel oops, panic, or hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:42:04.456Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e9aee7e4d9767cc3e423b3beecb01c7ebb6bbcd"
},
{
"url": "https://git.kernel.org/stable/c/fa2215cf451414b0512cd6f7d37a057893811f4d"
},
{
"url": "https://git.kernel.org/stable/c/d07e281f2a7710502985d6f80b95ddac8f4e81d5"
},
{
"url": "https://git.kernel.org/stable/c/a84f3db72561c4d9281c5ff721ce46b9ffa7f30e"
},
{
"url": "https://git.kernel.org/stable/c/7c4841e2a62794a3bab7c1ff0540580f387e377f"
}
],
"title": "fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90048",
"datePublished": "2026-09-16T10:33:44.538Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:42:04.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90047 (GCVE-0-2026-90047)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:42
VLAI
EPSS
VEX
Title
drm/xe: Don't hand out the flat CCS storage as usable VRAM
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Don't hand out the flat CCS storage as usable VRAM
get_flat_ccs_offset() reads the base of the flat CCS storage from the
hardware, scales it by the number of enabled L3 nodes, and rounds the
result up to 128K. Everything below that offset is then handed to the
VRAM allocator as usable memory.
Rounding a limit that means "usable memory ends here" upwards publishes
whatever lies between the real base and the rounded one as free memory,
and that memory belongs to the compression hardware. The scaled value
has no reason to be 128K aligned, and on a Battlemage G21 with 16 GiB it
is not:
flat CCS base: raw 0x3fafff800, rounded 0x3fb000000
so the last 2 KiB of page 0x3fafff000 is CCS storage, in the allocator's
pool. Whatever is allocated there gets that tail overwritten by the
compression hardware, which needs no page-table entry, no buffer object
and no GPU submission to do it, and does it before userspace exists.
On this machine a Mesa VM's level-3 page table landed on that page on
every cold boot. It lost the entry covering the compositor's
batch-buffer heap, so the compositor's first submission faulted fetching
its batch and gdm restarted it forever: a black screen on an otherwise
working machine. Restarting gdm cleared it because the next VM's page
tables were allocated somewhere else.
Round down instead, to the page size the allocator works in. On this
machine that excludes exactly one page.
Reading the reserved page afterwards shows what had been writing it:
[369] 0xcccc000000000000
[371] 0xcc77000000000000
[373] 0xcccc000000000000
[375] 0xcc77000000000000
compression metadata, two bytes per sixteen, sitting where the driver
used to hand out memory.
The assertion that should have caught this compares the offset against
GSMBASE - ccs_size for equality. That value is 128K aligned, so it
agrees with the rounded-up offset precisely when the base is not
aligned - the check cannot fail in the case it exists to catch, and is
compiled out unless CONFIG_DRM_XE_DEBUG is set. Replace it with one
that can fail: CCS storage must not run into GSM.
[ And this was a debug session from hell, enormously helped by an AI
doing much of the grunt-work.
I'd like to call it my tireless helper, but the AI several times
stated flat out that this was impossible and unsolvable and that we
should just write a report about it.
I suspect those things have been trained by people who may not be
quite as stubborn as I am.
But while the AI was ready to give up several times, it did keep
adding debug code and analyzing it faithfully when I pushed. So credit
where credit is due and I let the AI write the commit message above.
This is basically a one-liner fixing a bogus "round_up()" to a
"round_down()", but there were 24 patches adding more and more debug
information to this, and 18 kernel boot to finally narrow it down to
this. - Linus ]
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
37173392741c425191b959acb3adf70c9a4610c0 , < c96477e0cabf55bfbdf078078e9de1c8024f8060
(git)
Affected: 37173392741c425191b959acb3adf70c9a4610c0 , < 348c3db4f1520d36764ac8cae2492f50599714f6 (git) Affected: 37173392741c425191b959acb3adf70c9a4610c0 , < 818bebeb63dd6bf5f4e07e145f6cdbace520a34c (git) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_vram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c96477e0cabf55bfbdf078078e9de1c8024f8060",
"status": "affected",
"version": "37173392741c425191b959acb3adf70c9a4610c0",
"versionType": "git"
},
{
"lessThan": "348c3db4f1520d36764ac8cae2492f50599714f6",
"status": "affected",
"version": "37173392741c425191b959acb3adf70c9a4610c0",
"versionType": "git"
},
{
"lessThan": "818bebeb63dd6bf5f4e07e145f6cdbace520a34c",
"status": "affected",
"version": "37173392741c425191b959acb3adf70c9a4610c0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_vram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Don\u0027t hand out the flat CCS storage as usable VRAM\n\nget_flat_ccs_offset() reads the base of the flat CCS storage from the\nhardware, scales it by the number of enabled L3 nodes, and rounds the\nresult up to 128K. Everything below that offset is then handed to the\nVRAM allocator as usable memory.\n\nRounding a limit that means \"usable memory ends here\" upwards publishes\nwhatever lies between the real base and the rounded one as free memory,\nand that memory belongs to the compression hardware. The scaled value\nhas no reason to be 128K aligned, and on a Battlemage G21 with 16 GiB it\nis not:\n\n\tflat CCS base: raw 0x3fafff800, rounded 0x3fb000000\n\nso the last 2 KiB of page 0x3fafff000 is CCS storage, in the allocator\u0027s\npool. Whatever is allocated there gets that tail overwritten by the\ncompression hardware, which needs no page-table entry, no buffer object\nand no GPU submission to do it, and does it before userspace exists.\n\nOn this machine a Mesa VM\u0027s level-3 page table landed on that page on\nevery cold boot. It lost the entry covering the compositor\u0027s\nbatch-buffer heap, so the compositor\u0027s first submission faulted fetching\nits batch and gdm restarted it forever: a black screen on an otherwise\nworking machine. Restarting gdm cleared it because the next VM\u0027s page\ntables were allocated somewhere else.\n\nRound down instead, to the page size the allocator works in. On this\nmachine that excludes exactly one page.\n\nReading the reserved page afterwards shows what had been writing it:\n\n\t[369] 0xcccc000000000000\n\t[371] 0xcc77000000000000\n\t[373] 0xcccc000000000000\n\t[375] 0xcc77000000000000\n\ncompression metadata, two bytes per sixteen, sitting where the driver\nused to hand out memory.\n\nThe assertion that should have caught this compares the offset against\nGSMBASE - ccs_size for equality. That value is 128K aligned, so it\nagrees with the rounded-up offset precisely when the base is not\naligned - the check cannot fail in the case it exists to catch, and is\ncompiled out unless CONFIG_DRM_XE_DEBUG is set. Replace it with one\nthat can fail: CCS storage must not run into GSM.\n\n[ And this was a debug session from hell, enormously helped by an AI\n doing much of the grunt-work.\n\n I\u0027d like to call it my tireless helper, but the AI several times\n stated flat out that this was impossible and unsolvable and that we\n should just write a report about it.\n\n I suspect those things have been trained by people who may not be\n quite as stubborn as I am.\n\n But while the AI was ready to give up several times, it did keep\n adding debug code and analyzing it faithfully when I pushed. So credit\n where credit is due and I let the AI write the commit message above.\n\n This is basically a one-liner fixing a bogus \"round_up()\" to a\n \"round_down()\", but there were 24 patches adding more and more debug\n information to this, and 18 kernel boot to finally narrow it down to\n this. - Linus ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The oversized VRAM pool is used through local DRM render-node ioctls (DRM_IOCTL_XE_GEM_CREATE, DRM_IOCTL_XE_VM_CREATE/BIND) on /dev/dri/renderD*; xe_vram_probe() only runs at PCI driver init. There is no network, Bluetooth, or USB path into this Xe VRAM accounting code.\nAC:L - On affected Xe2 discrete GPUs the flat CCS base is not 128K-aligned, so one extra 4K CCS page is always in the TTM pool. 4K GPU page-table BOs land on that leftover fragment (every cold boot on the reported hardware), and CCS hardware overwrites it with no GPU submission required.\nPR:L - XE_GEM_CREATE and XE_VM_CREATE are DRM_RENDER_ALLOW, so any unprivileged local user who can open the Xe render node (typical desktop, workstation, and GPU-compute clients) can allocate VRAM and GPU page tables from the oversized pool; root or init-namespace capabilities are not required.\nUI:N - Exploitation uses only the attacker\u0027s own GEM/VM ioctls, and the compression hardware writes CCS into the overlapping page with no victim GPU submission. The compositor-fault/black-screen outcome also occurs on ordinary GPU bring-up with no separate user action.\nS:U - Aliasing CCS storage with allocated VRAM corrupts GPU page tables and buffer objects inside the host kernel\u0027s Xe/TTM security authority. This is not a guest-to-host VM escape or IOMMU/DMA bypass; the SR-IOV VF probe path skips get_flat_ccs_offset() entirely.\nC:H - A client can receive the overlapping page as a mappable VRAM BO (XE_GEM_CREATE plus XE_GEM_MMAP_OFFSET) and read Flat CCS metadata for other surfaces. When that page is a GPU page table, CCS overwrites PTEs so the GPU may translate into unintended physical pages, disclosing other clients\u0027 GPU memory.\nI:H - CCS hardware writes into kernel-managed GPU page tables and user BOs with no PTE, corrupting translations and buffer contents. A client that maps the overlapping page can also write CCS storage, breaking other clients\u0027 compression state and GPU PTEs, which is memory corruption scored as High integrity impact.\nA:H - Overwritten GPU page-table entries cause GPU page faults on batch fetch; the reported effect is a compositor crash and persistent gdm restart/black-screen loop, and the same corruption can wedge or reset the Xe GT. Kernel CVSS treats GPU hangs and crashes as High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:42:02.936Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c96477e0cabf55bfbdf078078e9de1c8024f8060"
},
{
"url": "https://git.kernel.org/stable/c/348c3db4f1520d36764ac8cae2492f50599714f6"
},
{
"url": "https://git.kernel.org/stable/c/818bebeb63dd6bf5f4e07e145f6cdbace520a34c"
}
],
"title": "drm/xe: Don\u0027t hand out the flat CCS storage as usable VRAM",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90047",
"datePublished": "2026-09-16T10:33:43.851Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:42:02.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90046 (GCVE-0-2026-90046)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:42
VLAI
EPSS
VEX
Title
mm/page_alloc: don't spin_trylock() in NMI on UP
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: don't spin_trylock() in NMI on UP
Patch series "mm/page_alloc: fixes for free_pages_nolock() on RT/UP".
Pre-existing bugs found by Sashiko during review of this other series:
https://lore.kernel.org/all/20260703-alloc-trylock-v5-0-c87b714e19d3@google.com/
I have not reproduced these bugs, and I suspect there is no real-world
user that is affected by them.
This patch (of 2):
As noted in can_spin_trylock(), using this is unsafe in this context.
commit 620b46ed6ae17 ("mm/page_alloc: return NULL early from
alloc_frozen_pages_nolock() in NMI on UP") fixed this on the alloc side
but missed the free side.
Impact: If BPF programs using these features in NMI (probably tracing) are
present on non-SMP builds this might crash the kernel and is probably
exploitable by local attackers for privilege escalation.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8c57b687e8331eb80e302a2c528b18b966a9ac7a , < 06c76d3c389ff504052f64b1acee44651bd847fa
(git)
Affected: 8c57b687e8331eb80e302a2c528b18b966a9ac7a , < 68a069b407303e71db371df85036101e8ff59280 (git) Affected: 8c57b687e8331eb80e302a2c528b18b966a9ac7a , < 3105ae628fb785d48b49256468be4f21a7b3cfc0 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/page_alloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06c76d3c389ff504052f64b1acee44651bd847fa",
"status": "affected",
"version": "8c57b687e8331eb80e302a2c528b18b966a9ac7a",
"versionType": "git"
},
{
"lessThan": "68a069b407303e71db371df85036101e8ff59280",
"status": "affected",
"version": "8c57b687e8331eb80e302a2c528b18b966a9ac7a",
"versionType": "git"
},
{
"lessThan": "3105ae628fb785d48b49256468be4f21a7b3cfc0",
"status": "affected",
"version": "8c57b687e8331eb80e302a2c528b18b966a9ac7a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/page_alloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: don\u0027t spin_trylock() in NMI on UP\n\nPatch series \"mm/page_alloc: fixes for free_pages_nolock() on RT/UP\".\n\nPre-existing bugs found by Sashiko during review of this other series:\nhttps://lore.kernel.org/all/20260703-alloc-trylock-v5-0-c87b714e19d3@google.com/\n\nI have not reproduced these bugs, and I suspect there is no real-world\nuser that is affected by them.\n\n\nThis patch (of 2):\n\nAs noted in can_spin_trylock(), using this is unsafe in this context. \ncommit 620b46ed6ae17 (\"mm/page_alloc: return NULL early from\nalloc_frozen_pages_nolock() in NMI on UP\") fixed this on the alloc side\nbut missed the free side.\n\nImpact: If BPF programs using these features in NMI (probably tracing) are\npresent on non-SMP builds this might crash the kernel and is probably\nexploitable by local attackers for privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - free_pages_nolock is reached from local BPF programs (arena/bpf_map_alloc_pages and related nolock helpers) running in NMI, typically a BPF_PROG_TYPE_PERF_EVENT overflow handler installed via bpf()/perf_event_open. It is not reachable from unauthenticated network packets or in-kernel servers such as ksmbd/nfsd.\nAC:L - Scoring assumes a uniprocessor (!CONFIG_SMP) kernel, a reasonable embedded/IoT deployment. An attacker who can attach a BPF perf-event program controls the NMI that calls free_pages_nolock and can concurrently run page-allocator work so the NMI interrupts zone-\u003elock; the in-tree slub_kunit NMI overflow test shows this reentry is reliably triggerable.\nPR:L - Loading the NMI BPF program requires CAP_BPF and CAP_PERFMON, which are sub-root capabilities. BPF tokens can delegate those checks into a non-init user namespace in plausible container/tracing deployments, so this is treated as low privileges rather than init-namespace root.\nUI:N - The attacker loads the BPF program, programs the PMU, and drives local memory activity themselves. No separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Re-entrant buddy/zone-lock corruption stays inside the kernel\u0027s own security authority and yields local privilege escalation, not a VM, IOMMU, or other cross-boundary escape.\nC:H - Nested spin_trylock of zone-\u003elock on UP lets the NMI mutate buddy freelists while the interrupted context is mid-update, corrupting page-allocator metadata. That overlapping-page primitive can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same freelist corruption is a well-known arbitrary-write and control-flow hijack primitive, and the fix commit states the bug is probably exploitable by local attackers for privilege escalation.\nA:H - Re-entrant zone-lock and buddy updates crash the kernel via oops, panic, or a DEBUG_SPINLOCK BUG on UP, which is a full availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:42:01.386Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06c76d3c389ff504052f64b1acee44651bd847fa"
},
{
"url": "https://git.kernel.org/stable/c/68a069b407303e71db371df85036101e8ff59280"
},
{
"url": "https://git.kernel.org/stable/c/3105ae628fb785d48b49256468be4f21a7b3cfc0"
}
],
"title": "mm/page_alloc: don\u0027t spin_trylock() in NMI on UP",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90046",
"datePublished": "2026-09-16T10:33:43.156Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:42:01.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90045 (GCVE-0-2026-90045)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
USB: gadget: ffs: fix mm lifetime handling
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: ffs: fix mm lifetime handling
io_data stores a pointer to the submitting task's mm_struct,
but does not currently hold a reference to it while async
requests are pending.
This can result in a use-after-free if the task exits before
completion handling finishes.
Take a reference with mmgrab() when queuing the read request
and release it with mmdrop() on request completion.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f3d31484b3f26d63c09e5569ebfaa1079a17f171
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7411de0ce3b45286de1de82526795658ea6eacb0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8 (git) Affected: 0 , < 6.18.51 (semver) Affected: 0 , < 7.2.5 (semver) |
|
| Linux | Linux |
Unaffected:
6.18.51 , ≤ 6.18.*
(semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3d31484b3f26d63c09e5569ebfaa1079a17f171",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7411de0ce3b45286de1de82526795658ea6eacb0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.18.51",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task\u0027s mm_struct,\nbut does not currently hold a reference to it while async\nrequests are pending.\n\nThis can result in a use-after-free if the task exits before\ncompletion handling finishes.\n\nTake a reference with mmgrab() when queuing the read request\nand release it with mmdrop() on request completion."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached via local aio_read/io_submit on FunctionFS ep files (ffs_epfile_read_iter \u2192 ffs_epfile_io), not by parsing USB host packets. This is the gadget userspace API; prior f_fs AIO UAFs (CVE-2024-36894, CVE-2025-71074) are scored Local, which is also the higher-severity vector versus Physical.\nAC:L - The attacker submits the AIO read, can complete it locally (dummy_hcd or an already-bound gadget) and exit while the ordered io_completion_wq worker is still pending. Both sides of the mm-lifetime race are attacker-driven and freely retryable, so this is not AC:H.\nPR:L - ffs_epfile_open has no capability check. FunctionFS mounts commonly set uid=/gid=/fmode= so unprivileged gadget daemons (adbd/shell, MTP) can open ep files; mounting needs init-namespace CAP_SYS_ADMIN, but using already-mounted endpoints does not.\nUI:N - The attacker performs io_submit and process exit itself. No separate victim action is required beyond an already-deployed FunctionFS gadget.\nS:U - The mm_struct use-after-free corrupts host kernel state within the same security authority. This is standard local kernel privilege escalation, not a VM, IOMMU, or sandbox escape.\nC:H - Use-after-free of mm_struct lets kthread_use_mm/switch_mm consume a reclaimed mm (including mm-\u003epgd) and copy_to_iter through attacker-influenced page tables, yielding an arbitrary read primitive. Per scoring guidance, UAF is Confidentiality High.\nI:H - kthread_use_mm on a sprayed mm_struct can install attacker-controlled page tables, and ffs_copy_to_iter then writes the USB payload through them, giving an arbitrary write and control-flow hijack primitive. Per scoring guidance, UAF is Integrity High.\nA:H - Using a freed mm_struct in kthread_use_mm/switch_mm and copy_to_iter reliably oopses or panics the kernel even without a full exploit, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:59.869Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171"
},
{
"url": "https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0"
},
{
"url": "https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8"
}
],
"title": "USB: gadget: ffs: fix mm lifetime handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90045",
"datePublished": "2026-09-16T10:33:42.411Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:41:59.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90044 (GCVE-0-2026-90044)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()
fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is
freed. However, for AIO operations, the kiocb cancel function was already
armed and kiocb->private was set to `p`.
If a concurrent cancel operation (such as sys_io_cancel()) executes after
ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free
can occur when the cancellation handler accesses the freed pointer.
To securely fix this race condition, we must properly un-arm the
cancellation. Invoking `kiocb->ki_complete()` does exactly this by
acquiring `ctx->ctx_lock` and safely removing the kiocb from the active
sequence. In doing so, it ensures that a parallel io_cancel can no longer
discover the kiocb, effectively closing the race window.
We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been
consumed and it should avoid attempting to complete the request again or
triggering subsequent completion handlers.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
de2080d41b5d584205e408d72021f0f335a046fc , < 153b5ecd29ed055562400bc17c91df3fd869b0ce
(git)
Affected: de2080d41b5d584205e408d72021f0f335a046fc , < 4a2fb2d12b87b43724230abb52a1440617c7b6cc (git) Affected: de2080d41b5d584205e408d72021f0f335a046fc , < e78dcb1f7ec271449c54984dc90c62a5ba272de7 (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "153b5ecd29ed055562400bc17c91df3fd869b0ce",
"status": "affected",
"version": "de2080d41b5d584205e408d72021f0f335a046fc",
"versionType": "git"
},
{
"lessThan": "4a2fb2d12b87b43724230abb52a1440617c7b6cc",
"status": "affected",
"version": "de2080d41b5d584205e408d72021f0f335a046fc",
"versionType": "git"
},
{
"lessThan": "e78dcb1f7ec271449c54984dc90c62a5ba272de7",
"status": "affected",
"version": "de2080d41b5d584205e408d72021f0f335a046fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix Use-After-Free in AIO error path\n\nIn ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()\nfails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is\nfreed. However, for AIO operations, the kiocb cancel function was already\narmed and kiocb-\u003eprivate was set to `p`.\n\nIf a concurrent cancel operation (such as sys_io_cancel()) executes after\nffs_epfile_io() fails but before the function frees `p`, a Use-After-Free\ncan occur when the cancellation handler accesses the freed pointer.\n\nTo securely fix this race condition, we must properly un-arm the\ncancellation. Invoking `kiocb-\u003eki_complete()` does exactly this by\nacquiring `ctx-\u003ectx_lock` and safely removing the kiocb from the active\nsequence. In doing so, it ensures that a parallel io_cancel can no longer\ndiscover the kiocb, effectively closing the race window.\n\nWe then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been\nconsumed and it should avoid attempting to complete the request again or\ntriggering subsequent completion handlers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in FunctionFS epfile AIO (`ffs_epfile_write_iter`/`read_iter` via `io_submit`/`io_cancel` on functionfs ep files), a local syscall path. `ffs_epfile_io()` can fail with `-EAGAIN` on `O_NONBLOCK` before any USB host is involved; this is the gadget userspace API, matching CVE-2024-36894/CVE-2026-63894 as Local rather than Physical.\nAC:L - The attacker controls both sides: one thread `io_submit`s AIO that fails after `kiocb_set_cancel_fn` (O_NONBLOCK `-EAGAIN`, halt, `-EFAULT`), while another calls `io_cancel`/`io_destroy`. The race between `kfree(p)` and `aio_remove_iocb` is freely retryable, so a race the attacker creates is AC:L.\nPR:L - FunctionFS mounts commonly use `uid=`/`gid=`/`fmode=` to delegate ep files to unprivileged gadget daemons (adbd/shell on Android, MTP, embedded USB services). Once mounted by init, those accounts can open ep files and issue AIO without init-namespace root.\nUI:N - The attacker performs `io_submit` and `io_cancel`/`io_destroy` on their own FunctionFS endpoint fds. No separate victim action is required beyond an already-deployed FunctionFS gadget.\nS:U - The use-after-free corrupts kernel heap (`ffs_io_data`) within the same host kernel security authority. This is ordinary local privilege escalation, not a VM escape or IOMMU/sandbox boundary cross.\nC:H - Use-after-free of `ffs_io_data`: `ffs_aio_cancel()` reads `kiocb-\u003eprivate` after `kfree`. Reclaim of that kmalloc object lets the attacker control `io_data-\u003eep`/`req` and leak kernel memory via UDC dequeue; UAFs are scored High for confidentiality.\nI:H - A reclaimed `ffs_io_data` yields attacker-controlled pointers passed to `usb_ep_dequeue()` from `ffs_aio_cancel`, providing a heap write and control-flow hijack primitive. Kernel UAFs are scored High for integrity.\nA:H - Dereferencing the freed `ffs_io_data` in `ffs_aio_cancel` causes kernel oops/panic even without a full exploit; any such crash is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:58.245Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce"
},
{
"url": "https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc"
},
{
"url": "https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7"
}
],
"title": "usb: gadget: f_fs: Fix Use-After-Free in AIO error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90044",
"datePublished": "2026-09-16T10:33:41.695Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:41:58.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90043 (GCVE-0-2026-90043)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
zram: fix slot lock bit position on big-endian 64-bit
Summary
In the Linux kernel, the following vulnerability has been resolved:
zram: fix slot lock bit position on big-endian 64-bit
The slot lock is a bit operation on the whole __lock word, which flags and
ac_time alias as two u32s. On little-endian the lock bit lands in the
position ZRAM_ENTRY_LOCK reserves in flags, so the aliasing works out. On
64-bit big-endian it lands in ac_time instead: with
ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time from
mark_slot_accessed() or slot_free() wipes out the held lock bit, letting
another CPU take the same slot lock; an access time value with that bit
set makes the slot look locked forever.
Shift the lock bit into the flags half of the word on big-endian 64-bit.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2e8ff2f51dde73a26b94aed2df4827177bd25e6e , < 052b6b2d5fe97547bd2cdb73fa894f6cfea68b11
(git)
Affected: 2e8ff2f51dde73a26b94aed2df4827177bd25e6e , < a8b5875741d416703e19ad8eeac6fce8a12bd6e4 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/zram/zram_drv.c",
"drivers/block/zram/zram_drv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "052b6b2d5fe97547bd2cdb73fa894f6cfea68b11",
"status": "affected",
"version": "2e8ff2f51dde73a26b94aed2df4827177bd25e6e",
"versionType": "git"
},
{
"lessThan": "a8b5875741d416703e19ad8eeac6fce8a12bd6e4",
"status": "affected",
"version": "2e8ff2f51dde73a26b94aed2df4827177bd25e6e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/zram/zram_drv.c",
"drivers/block/zram/zram_drv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix slot lock bit position on big-endian 64-bit\n\nThe slot lock is a bit operation on the whole __lock word, which flags and\nac_time alias as two u32s. On little-endian the lock bit lands in the\nposition ZRAM_ENTRY_LOCK reserves in flags, so the aliasing works out. On\n64-bit big-endian it lands in ac_time instead: with\nZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time from\nmark_slot_accessed() or slot_free() wipes out the held lock bit, letting\nanother CPU take the same slot lock; an access time value with that bit\nset makes the slot look locked forever.\n\nShift the lock bit into the flags half of the word on big-endian 64-bit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The broken slot lock lives in the zram block driver and is reached only through local I/O: zram_submit_bio() for read/write/discard and zram_slot_free_notify() from swap. It is not in a network protocol parser, Bluetooth/WiFi path, or a physical-device driver.\nAC:L - On 64-bit big-endian kernels with CONFIG_ZRAM_TRACK_ENTRY_ACTIME, slot_free() zeros ac_time (the lock bit) immediately after slot_lock(), so exclusion is dropped on every free. An attacker who issues concurrent reads, writes, discards, or swap faults against the same zram page controls both sides of the race.\nPR:L - zram_open() and zram_submit_bio() impose no capability check. In the highest-impact setup zram is already swap or mounted scratch storage, so an unprivileged local user can induce paging or file I/O that hits the slot lock; admin-only device creation is only an environmental prerequisite.\nUI:N - After zram is configured as swap or writable storage, the attacker triggers the vulnerable path directly via memory pressure, page faults, madvise, or ordinary file I/O. No victim must mount a filesystem, open a crafted file, or otherwise participate.\nS:U - Impact is corruption of in-kernel zram table entries and zsmalloc objects on the same host. That is a standard kernel compromise and does not cross a VM, IOMMU, or other separate security authority.\nC:H - Clearing the held slot lock lets one CPU zs_free() a zsmalloc object while another still maps it in read_from_zspool()/zs_obj_read_begin(). That use-after-free of compressed-page heap objects can be reused for arbitrary kernel reads.\nI:H - The same lost exclusion allows double-free of zsmalloc handles and torn updates of slot handle and flags, so a racing writer can free an object another CPU still uses or install a new handle over a live one, enabling arbitrary kernel writes and control-flow hijack.\nA:H - Concurrent zs_free versus zs_obj_read_begin on the same handle can oops or panic the kernel, and an ac_time value that leaves the lock bit set makes later wait_on_bit_lock() sleep uninterruptibly forever on that slot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:56.643Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/052b6b2d5fe97547bd2cdb73fa894f6cfea68b11"
},
{
"url": "https://git.kernel.org/stable/c/a8b5875741d416703e19ad8eeac6fce8a12bd6e4"
}
],
"title": "zram: fix slot lock bit position on big-endian 64-bit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90043",
"datePublished": "2026-09-16T10:33:40.907Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:41:56.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90042 (GCVE-0-2026-90042)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
ceph: properly decrypt filenames in vmalloc() buffers
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: properly decrypt filenames in vmalloc() buffers
The fscrypt subsystem uses the scatterlist crypto API, inheriting its
requirement that any buffers are in the linear mapping region. However,
the messenger client uses kvmalloc() to create buffers for messages,
which will occasionally place those buffers in the vmalloc() region when
physical memory fragmentation doesn't permit a large enough kmalloc().
The various callers of ceph_fname_to_usr() directly pass (slices of) raw
messages from the MDS without considering that the messages may be in
vmalloc() buffers, resulting in oopses especially on non-x86 platforms
(see 'Closes:' for more details and a reproducer).
Make ceph_fname_to_usr() explicitly tolerant of vmalloc()-allocated
fname->ctext, fname->name, and/or oname->name buffers, using `tname`
(which, when non-null, must be a linear address; when null, is briefly
allocated as necessary) as a bounce buffer to avoid passing any
inappropriate addresses to fscrypt_fname_disk_to_usr().
Additionally change parse_reply_info_readdir() -- the only function to
supply its own `tname` -- to follow the new "tname must never come from
vmalloc()" rule by passing NULL when the message is not in the linear
region. Though this causes a per-dentry kmalloc()+kfree(), this overhead
exists only when processing the minority of messages that spill into
vmalloc(). My (crude) testing puts this at only about 1 in 8,000 readdir
messages. Still, if the overhead proves unreasonable in the future, it
is easy enough to mitigate: a future change could allocate a bounce
buffer in parse_reply_info_readdir() and use that as `tname` instead.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
457117f077c6749d1e28469eae91fb69c9806768 , < 110747ff535e3d98ac17d68dbd056bb6ef000e23
(git)
Affected: 457117f077c6749d1e28469eae91fb69c9806768 , < 3b467c68803d7c7e82678289e598afd44faa6101 (git) Affected: 457117f077c6749d1e28469eae91fb69c9806768 , < e939fc6a7bd969a58a150b7f188c1047138403e3 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/crypto.c",
"fs/ceph/mds_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "110747ff535e3d98ac17d68dbd056bb6ef000e23",
"status": "affected",
"version": "457117f077c6749d1e28469eae91fb69c9806768",
"versionType": "git"
},
{
"lessThan": "3b467c68803d7c7e82678289e598afd44faa6101",
"status": "affected",
"version": "457117f077c6749d1e28469eae91fb69c9806768",
"versionType": "git"
},
{
"lessThan": "e939fc6a7bd969a58a150b7f188c1047138403e3",
"status": "affected",
"version": "457117f077c6749d1e28469eae91fb69c9806768",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/crypto.c",
"fs/ceph/mds_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: properly decrypt filenames in vmalloc() buffers\n\nThe fscrypt subsystem uses the scatterlist crypto API, inheriting its\nrequirement that any buffers are in the linear mapping region. However,\nthe messenger client uses kvmalloc() to create buffers for messages,\nwhich will occasionally place those buffers in the vmalloc() region when\nphysical memory fragmentation doesn\u0027t permit a large enough kmalloc().\nThe various callers of ceph_fname_to_usr() directly pass (slices of) raw\nmessages from the MDS without considering that the messages may be in\nvmalloc() buffers, resulting in oopses especially on non-x86 platforms\n(see \u0027Closes:\u0027 for more details and a reproducer).\n\nMake ceph_fname_to_usr() explicitly tolerant of vmalloc()-allocated\nfname-\u003ectext, fname-\u003ename, and/or oname-\u003ename buffers, using `tname`\n(which, when non-null, must be a linear address; when null, is briefly\nallocated as necessary) as a bounce buffer to avoid passing any\ninappropriate addresses to fscrypt_fname_disk_to_usr().\n\nAdditionally change parse_reply_info_readdir() -- the only function to\nsupply its own `tname` -- to follow the new \"tname must never come from\nvmalloc()\" rule by passing NULL when the message is not in the linear\nregion. Though this causes a per-dentry kmalloc()+kfree(), this overhead\nexists only when processing the minority of messages that spill into\nvmalloc(). My (crude) testing puts this at only about 1 in 8,000 readdir\nmessages. Still, if the overhead proves unreasonable in the future, it\nis easy enough to mitigate: a future change could allocate a bounce\nbuffer in parse_reply_info_readdir() and use that as `tname` instead."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ceph_fname_to_usr() runs while parsing CEPH_MSG_CLIENT_REPLY on the kernel CephFS client TCP session (mds_dispatch \u2192 handle_reply \u2192 parse_reply_info_readdir/fill_trace); a malicious or compromised MDS delivers the kvmalloc\u0027d filename buffers that are passed into fscrypt.\nAC:L - The MDS fully controls hdr.front_len (up to CEPH_MSG_MAX_FRONT_LEN, 16MB). kvmalloc() of that size skips costly kmalloc reclaim and falls back to vmalloc deterministically, so sg_init_one() on the message names does not depend on incidental fragmentation or a race.\nPR:N - The attacker is the remote MDS peer on an already-connected kernel CephFS client and needs no Linux UID, capability, or init-namespace root on the victim, matching other MDS-driven client CVEs such as CVE-2026-89651.\nUI:N - Once encrypted CephFS is mounted with keys loaded (standard in Rook/Kubernetes/OpenStack, including NFS re-export LOOKUPNAME), readdir and lookup replies are processed automatically in the ceph-msgr path with no further victim mount or interactive step at exploit time.\nS:U - Wrong-page scatterlist crypto and any resulting kernel memory corruption stay inside the victim host\u0027s CephFS client and do not cross a VM, IOMMU, or sandbox security boundary.\nC:H - fname_decrypt() builds src_sg with sg_set_buf()/virt_to_page() on the vmalloc MDS buffer, so skcipher decryption reads unintended kernel pages as ciphertext; that memory-corruption read is High per kernel UAF/wrong-page guidance.\nI:H - parse_reply_info_readdir() decrypts filenames in place, so dst_sg also aliases the vmalloc message; crypto_skcipher_decrypt() then writes plaintext through virt_to_page() of a non-linear address, a wrong-page kernel write scored High.\nA:H - Passing vmalloc addresses into the scatterlist crypto API oopses or panics, especially on non-x86 where virt_to_page() of a non-linear address faults in scatterwalk, and a malicious MDS can repeat this on every encrypted readdir reply."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:54.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/110747ff535e3d98ac17d68dbd056bb6ef000e23"
},
{
"url": "https://git.kernel.org/stable/c/3b467c68803d7c7e82678289e598afd44faa6101"
},
{
"url": "https://git.kernel.org/stable/c/e939fc6a7bd969a58a150b7f188c1047138403e3"
}
],
"title": "ceph: properly decrypt filenames in vmalloc() buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90042",
"datePublished": "2026-09-16T10:33:40.210Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:41:54.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90041 (GCVE-0-2026-90041)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
HID: sony: clean up device list on probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: sony: clean up device list on probe failure
sony_input_configured() adds some controllers to sony_device_list before
HID core registers their input devices. input_register_device() can fail
after the callback returns successfully. sony_probe() then observes that
HID_CLAIMED_INPUT is clear and unwinds, but only stops the HID hardware.
The devres-managed sony_sc is freed while its list node remains linked, so
the next matching controller traverses freed memory.
Initialize the list node and device ID to inactive states. Make list
removal idempotent and run the driver-private cleanup on every probe
failure path. This also makes a second cleanup safe when
sony_input_configured() already unwound a partial initialization before
sony_probe() handles the missing input claim.
Found by 0sec (https://0sec.ai) using automated source analysis;
verified against the HID input registration and probe unwind paths.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4f967f6d73746f66514528cc1191025f0b5d69b3 , < 3b4709e4864908bb06c48c500cc8db8d3d55d139
(git)
Affected: 4f967f6d73746f66514528cc1191025f0b5d69b3 , < d044d796e2a369c6051c7e83dce88c7baa2494d4 (git) Affected: 4f967f6d73746f66514528cc1191025f0b5d69b3 , < 7c65699a3a311198a07659a614fe64d45924839e (git) |
|
| Linux | Linux |
Affected:
4.10
Unaffected: 0 , < 4.10 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-sony.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b4709e4864908bb06c48c500cc8db8d3d55d139",
"status": "affected",
"version": "4f967f6d73746f66514528cc1191025f0b5d69b3",
"versionType": "git"
},
{
"lessThan": "d044d796e2a369c6051c7e83dce88c7baa2494d4",
"status": "affected",
"version": "4f967f6d73746f66514528cc1191025f0b5d69b3",
"versionType": "git"
},
{
"lessThan": "7c65699a3a311198a07659a614fe64d45924839e",
"status": "affected",
"version": "4f967f6d73746f66514528cc1191025f0b5d69b3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-sony.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: sony: clean up device list on probe failure\n\nsony_input_configured() adds some controllers to sony_device_list before\nHID core registers their input devices. input_register_device() can fail\nafter the callback returns successfully. sony_probe() then observes that\nHID_CLAIMED_INPUT is clear and unwinds, but only stops the HID hardware.\nThe devres-managed sony_sc is freed while its list node remains linked, so\nthe next matching controller traverses freed memory.\n\nInitialize the list node and device ID to inactive states. Make list\nremoval idempotent and run the driver-private cleanup on every probe\nfailure path. This also makes a second cleanup safe when\nsony_input_configured() already unwound a partial initialization before\nsony_probe() handles the missing input claim.\n\nFound by 0sec (https://0sec.ai) using automated source analysis;\nverified against the HID input registration and probe unwind paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - hid-sony binds HID_BLUETOOTH_DEVICE IDs for Sixaxis/DualShock 3 (Sony 0x0268), Navigation, Motion, and related controllers, so a nearby Bluetooth HID/HIDP peer spoofing those identities reaches sony_probe() and sony_check_add() over L2CAP; USB enumeration is only a lower-severity physical path.\nAC:L - A rogue controller fully controls the HID descriptor and feature-report replies used in sony_input_configured(), which links sony_sc onto sony_device_list before input_register_device(); the attacker then reconnects a second matching device so sony_check_add_dev_list() walks the dangling node, with no race outside its control.\nPR:N - A malicious Bluetooth HID peripheral is sufficient: hidp/usbhid enumerates the device and sony_probe() runs during bind, with no local account, capability, or init-namespace privilege required on the victim.\nUI:N - sony_input_configured() and the HID_CLAIMED_INPUT unwind run from hid_hw_start() as soon as the spoofed Sixaxis/Motion/Navigation device connects or auto-reconnects; no extra victim open, mount, or confirmation is required.\nS:U - The use-after-free is of driver-private sony_sc on the host kernel HID list and does not cross a VM, IOMMU, or other separate security authority.\nC:H - After probe fails, devres frees sony_sc while sony_device_list still points at it; the next sony_check_add_dev_list() list_for_each_entry() reads mac_address and list pointers from the freed heap object, and UAF of this structure enables arbitrary kernel disclosure via spray/reuse.\nI:H - The dangling list_node is embedded in sony_sc alongside send_output_report, work_struct, and hid_device pointers; a second probe\u0027s list walk and later driver callbacks on a sprayed object yield an attacker-controlled kernel write and control-flow hijack primitive.\nA:H - Walking the freed list_node in sony_check_add_dev_list() is a KASAN slab-use-after-free and causes a kernel oops or panic when the slot is not reused, so any trigger of this UAF is a full host denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:52.635Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b4709e4864908bb06c48c500cc8db8d3d55d139"
},
{
"url": "https://git.kernel.org/stable/c/d044d796e2a369c6051c7e83dce88c7baa2494d4"
},
{
"url": "https://git.kernel.org/stable/c/7c65699a3a311198a07659a614fe64d45924839e"
}
],
"title": "HID: sony: clean up device list on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90041",
"datePublished": "2026-09-16T10:33:39.499Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T14:41:52.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90040 (GCVE-0-2026-90040)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force
vCPUs to reload/recheck their guest-provided VMSA if the backing gmem
page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core
logic to handle invalidations as VMX does for the APIC-access page, as the
two concepts are nearly identical: shove the physical address of a page
into the vCPU's control structure:
1. Snapshot the invalidation sequence counter
2. Grab the pfn (from guest_memfd in this case)
3. Acquire mmu_lock for read
4. Re-request reload if retry is needed, otherwise commit the change.
Note, the re-request action in #4 is necessary as KVM's retry logic is
fuzzy, i.e. can get false positives. If the guest_memfd page has been
dropped, at some point a subsequent reload will fail to get a PFN from
guest_memfd, and KVM will fail KVM_RUN. If the retry was due to a false
positive, KVM will retry until there are no relevant MMU notifier events
(and will retry in the "outer" loop, i.e. will drop locks and resched as
needed).
Note #2! Take care to invalidate the VMSA when a relevant memslot is
DELETED or MOVED, as invalidations in response to PUNCH_HOLE are predicated
on memslot bindings (KVM doesn't know what GFN range(s) to invalidate
without a binding). And more importantly, the VMSA mapping requires a
memslot, i.e. must be invalidated if its memslots disappears, regardless of
the state of the underlying guest_memfd inode.
Failure to invalidate the vCPU's control.vmsa_pa (which is checked by
pre_sev_run()) can prevent KVM from properly freeing the page as firmware
will reject the RMPUPDATE to reclaim the page with FAIL_INUSE if the vCPU
is actively running, i.e. if VMSA page is in-use. That in turn leads to an
RMP #PF on the next use, as the page will still be assigned to the SNP VM.
SEV-SNP: RMPUPDATE failed for PFN 78d198, pg_level: 1, ret: 3
SEV-SNP: PFN 0x78d198, RMP entry: [0xfff0000000144001 - 0x000000000000000f]
CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O
Tainted: [U]=USER, [O]=OOT_MODULE
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026
Call Trace:
<TASK>
dump_stack_lvl+0x54/0x70
rmpupdate+0x12c/0x140
rmp_make_shared+0x3b/0x60
sev_gmem_invalidate+0xe0/0x170 [kvm_amd]
delete_from_page_cache_batch+0x1d8/0x220
truncate_inode_pages_range+0x120/0x3d0
kvm_gmem_fallocate+0x19a/0x270 [kvm]
vfs_fallocate+0x1bc/0x1f0
__x64_sys_fallocate+0x48/0x70
do_syscall_64+0x10a/0x480
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x496c7e
</TASK>
------------[ cut here ]------------
SEV: Failed to update RMP entry for PFN 0x78d198 error -14
WARNING: arch/x86/kvm/svm/sev.c:5160 at sev_gmem_invalidate+0x126/0x170 [kvm_amd], CPU#3: sev_snp_vmsa_pu/31345
CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O
Tainted: [U]=USER, [O]=OOT_MODULE
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026
RIP: 0010:sev_gmem_invalidate+0x12b/0x170 [kvm_amd]
Call Trace:
<TASK>
delete_from_page_cache_batch+0x1d8/0x220
truncate_inode_pages_range+0x120/0x3d0
kvm_gmem_fallocate+0x19a/0x270 [kvm]
vfs_fallocate+0x1bc/0x1f0
__x64_sys_fallocate+0x48/0x70
do_syscall_64+0x10a/0x480
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x496c7e
</TASK>
irq event stamp: 20689
hardirqs last enabled at (20699): [<ffffffff8e76092c>] __console_unlock+0x5c/0x60
hardirqs last disabled at (20708): [<ffffffff8e760911>] __console_unlock+0x41/0x60
softirqs last enabled at (20722): [<ffffffff8e6cd74e>] __irq_exit_rcu+0x7e/0x140
softirqs last disabled at (20717): [<ffffffff8e6cd74e>] __irq_exit_rcu+0x7e/0x140
---[ end trace 0000000000000000 ]---
BUG: unable to handle page fault for address: ffff99
---truncated---
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e366f92ea99e1961fbad5e2110900e9f4fcb249b , < 2640cc26ed0dd1bf6ec2f6852a60e494093db3e5
(git)
Affected: e366f92ea99e1961fbad5e2110900e9f4fcb249b , < d1a3c216233413f57f5341a9b878b7e2dde7e785 (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/kvm-x86-ops.h",
"arch/x86/include/asm/kvm_host.h",
"arch/x86/kvm/mmu/mmu.c",
"arch/x86/kvm/svm/sev.c",
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/svm/svm.h",
"arch/x86/kvm/x86.c",
"include/linux/kvm_host.h",
"virt/kvm/guest_memfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2640cc26ed0dd1bf6ec2f6852a60e494093db3e5",
"status": "affected",
"version": "e366f92ea99e1961fbad5e2110900e9f4fcb249b",
"versionType": "git"
},
{
"lessThan": "d1a3c216233413f57f5341a9b878b7e2dde7e785",
"status": "affected",
"version": "e366f92ea99e1961fbad5e2110900e9f4fcb249b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/kvm-x86-ops.h",
"arch/x86/include/asm/kvm_host.h",
"arch/x86/kvm/mmu/mmu.c",
"arch/x86/kvm/svm/sev.c",
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/svm/svm.h",
"arch/x86/kvm/x86.c",
"include/linux/kvm_host.h",
"virt/kvm/guest_memfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped\n\nWire up a gmem_invalidate_range() call for SNP VMs, and use it to force\nvCPUs to reload/recheck their guest-provided VMSA if the backing gmem\npage is being invalidated, e.g. is being PUNCH_HOLE\u0027d. Use the same core\nlogic to handle invalidations as VMX does for the APIC-access page, as the\ntwo concepts are nearly identical: shove the physical address of a page\ninto the vCPU\u0027s control structure:\n\n 1. Snapshot the invalidation sequence counter\n 2. Grab the pfn (from guest_memfd in this case)\n 3. Acquire mmu_lock for read\n 4. Re-request reload if retry is needed, otherwise commit the change.\n\nNote, the re-request action in #4 is necessary as KVM\u0027s retry logic is\nfuzzy, i.e. can get false positives. If the guest_memfd page has been\ndropped, at some point a subsequent reload will fail to get a PFN from\nguest_memfd, and KVM will fail KVM_RUN. If the retry was due to a false\npositive, KVM will retry until there are no relevant MMU notifier events\n(and will retry in the \"outer\" loop, i.e. will drop locks and resched as\nneeded).\n\nNote #2! Take care to invalidate the VMSA when a relevant memslot is\nDELETED or MOVED, as invalidations in response to PUNCH_HOLE are predicated\non memslot bindings (KVM doesn\u0027t know what GFN range(s) to invalidate\nwithout a binding). And more importantly, the VMSA mapping requires a\nmemslot, i.e. must be invalidated if its memslots disappears, regardless of\nthe state of the underlying guest_memfd inode.\n\nFailure to invalidate the vCPU\u0027s control.vmsa_pa (which is checked by\npre_sev_run()) can prevent KVM from properly freeing the page as firmware\nwill reject the RMPUPDATE to reclaim the page with FAIL_INUSE if the vCPU\nis actively running, i.e. if VMSA page is in-use. That in turn leads to an\nRMP #PF on the next use, as the page will still be assigned to the SNP VM.\n\n SEV-SNP: RMPUPDATE failed for PFN 78d198, pg_level: 1, ret: 3\n SEV-SNP: PFN 0x78d198, RMP entry: [0xfff0000000144001 - 0x000000000000000f]\n CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x54/0x70\n rmpupdate+0x12c/0x140\n rmp_make_shared+0x3b/0x60\n sev_gmem_invalidate+0xe0/0x170 [kvm_amd]\n delete_from_page_cache_batch+0x1d8/0x220\n truncate_inode_pages_range+0x120/0x3d0\n kvm_gmem_fallocate+0x19a/0x270 [kvm]\n vfs_fallocate+0x1bc/0x1f0\n __x64_sys_fallocate+0x48/0x70\n do_syscall_64+0x10a/0x480\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x496c7e\n \u003c/TASK\u003e\n ------------[ cut here ]------------\n SEV: Failed to update RMP entry for PFN 0x78d198 error -14\n WARNING: arch/x86/kvm/svm/sev.c:5160 at sev_gmem_invalidate+0x126/0x170 [kvm_amd], CPU#3: sev_snp_vmsa_pu/31345\n CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026\n RIP: 0010:sev_gmem_invalidate+0x12b/0x170 [kvm_amd]\n Call Trace:\n \u003cTASK\u003e\n delete_from_page_cache_batch+0x1d8/0x220\n truncate_inode_pages_range+0x120/0x3d0\n kvm_gmem_fallocate+0x19a/0x270 [kvm]\n vfs_fallocate+0x1bc/0x1f0\n __x64_sys_fallocate+0x48/0x70\n do_syscall_64+0x10a/0x480\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x496c7e\n \u003c/TASK\u003e\n irq event stamp: 20689\n hardirqs last enabled at (20699): [\u003cffffffff8e76092c\u003e] __console_unlock+0x5c/0x60\n hardirqs last disabled at (20708): [\u003cffffffff8e760911\u003e] __console_unlock+0x41/0x60\n softirqs last enabled at (20722): [\u003cffffffff8e6cd74e\u003e] __irq_exit_rcu+0x7e/0x140\n softirqs last disabled at (20717): [\u003cffffffff8e6cd74e\u003e] __irq_exit_rcu+0x7e/0x140\n ---[ end trace 0000000000000000 ]---\n BUG: unable to handle page fault for address: ffff99\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:38.790Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2640cc26ed0dd1bf6ec2f6852a60e494093db3e5"
},
{
"url": "https://git.kernel.org/stable/c/d1a3c216233413f57f5341a9b878b7e2dde7e785"
}
],
"title": "KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90040",
"datePublished": "2026-09-16T10:33:38.790Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T10:33:38.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90039 (GCVE-0-2026-90039)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
NFSD: Guard admin state-revocation walks with NFSD_NET_UP
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Guard admin state-revocation walks with NFSD_NET_UP
Writing to /proc/fs/nfsd/unlock_filesystem, or sending the
NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command,
walks the NFSv4 client hash tables to revoke open state and cancel
async COPY operations. All three handlers gate that walk on
nn->nfsd_serv, but a listener added via portlist or netlink
listener_set sets nn->nfsd_serv before any nfsd thread starts.
nfsd_startup_net() has not yet allocated nn->conf_id_hashtbl, so the
walkers dereference a NULL table. A local administrator with
CAP_SYS_ADMIN can crash the kernel this way without ever starting the
server.
nn->nfsd_serv is set when the service is created, which precedes
table allocation. NFSD_NET_UP instead brackets the window where the
tables are live: set at the end of nfsd_startup_net() and cleared in
nfsd_shutdown_net() after they are freed, both under nfsd_mutex.
Gating the three unlock paths on NFSD_NET_UP fixes the startup-time
NULL dereference while preserving the earlier post-shutdown
use-after-free fix.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1ac3629bf012592cb0320e52a1cceb319a05ad17 , < 104a51265042b4424085741c963cb858ac29ec0b
(git)
Affected: 1ac3629bf012592cb0320e52a1cceb319a05ad17 , < 0146467a2fce845cb6629979c3e9c58dd3d3a6a3 (git) Affected: 1ac3629bf012592cb0320e52a1cceb319a05ad17 , < 2f3e6638aebc0ab8afb8b4e9816ea9a1cad85378 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4state.c",
"fs/nfsd/nfsctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "104a51265042b4424085741c963cb858ac29ec0b",
"status": "affected",
"version": "1ac3629bf012592cb0320e52a1cceb319a05ad17",
"versionType": "git"
},
{
"lessThan": "0146467a2fce845cb6629979c3e9c58dd3d3a6a3",
"status": "affected",
"version": "1ac3629bf012592cb0320e52a1cceb319a05ad17",
"versionType": "git"
},
{
"lessThan": "2f3e6638aebc0ab8afb8b4e9816ea9a1cad85378",
"status": "affected",
"version": "1ac3629bf012592cb0320e52a1cceb319a05ad17",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4state.c",
"fs/nfsd/nfsctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Guard admin state-revocation walks with NFSD_NET_UP\n\nWriting to /proc/fs/nfsd/unlock_filesystem, or sending the\nNFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command,\nwalks the NFSv4 client hash tables to revoke open state and cancel\nasync COPY operations. All three handlers gate that walk on\nnn-\u003enfsd_serv, but a listener added via portlist or netlink\nlistener_set sets nn-\u003enfsd_serv before any nfsd thread starts.\nnfsd_startup_net() has not yet allocated nn-\u003econf_id_hashtbl, so the\nwalkers dereference a NULL table. A local administrator with\nCAP_SYS_ADMIN can crash the kernel this way without ever starting the\nserver.\n\nnn-\u003enfsd_serv is set when the service is created, which precedes\ntable allocation. NFSD_NET_UP instead brackets the window where the\ntables are live: set at the end of nfsd_startup_net() and cleared in\nnfsd_shutdown_net() after they are freed, both under nfsd_mutex.\nGating the three unlock paths on NFSD_NET_UP fixes the startup-time\nNULL dereference while preserving the earlier post-shutdown\nuse-after-free fix."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:38.091Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/104a51265042b4424085741c963cb858ac29ec0b"
},
{
"url": "https://git.kernel.org/stable/c/0146467a2fce845cb6629979c3e9c58dd3d3a6a3"
},
{
"url": "https://git.kernel.org/stable/c/2f3e6638aebc0ab8afb8b4e9816ea9a1cad85378"
}
],
"title": "NFSD: Guard admin state-revocation walks with NFSD_NET_UP",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90039",
"datePublished": "2026-09-16T10:33:38.091Z",
"dateReserved": "2026-09-11T19:38:34.783Z",
"dateUpdated": "2026-09-16T10:33:38.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90038 (GCVE-0-2026-90038)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
NFSD: Prevent client use-after-free during export state revocation
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during export state revocation
nfsd4_revoke_export_states() has the same use-after-free as
nfsd4_revoke_states(): it drops nn->client_lock across
revoke_one_stid() and the following read of clp->cl_minorversion, but
the stateid reference it holds does not pin the client. A teardown
racing the dropped lock can free the client while revoke_one_stid()
still dereferences it.
exportfs -u drives this path through NFSD_CMD_UNLOCK_EXPORT, so an
administrator removing an export can race a client expiry.
Skip a client that is already expiring and otherwise pin it with
cl_rpc_users under client_lock before dropping the lock, matching
nfsd4_revoke_states().
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2eac189bb059d31a29937b29ee0f477394198610 , < c05ae58fe06ce2ac34312f649e71c3596bdde358
(git)
Affected: 2eac189bb059d31a29937b29ee0f477394198610 , < 2108de53568a64936a0da3e04d85c35df98d3fb6 (git) |
|
| Linux | Linux |
Affected:
7.2
Unaffected: 0 , < 7.2 (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c05ae58fe06ce2ac34312f649e71c3596bdde358",
"status": "affected",
"version": "2eac189bb059d31a29937b29ee0f477394198610",
"versionType": "git"
},
{
"lessThan": "2108de53568a64936a0da3e04d85c35df98d3fb6",
"status": "affected",
"version": "2eac189bb059d31a29937b29ee0f477394198610",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during export state revocation\n\nnfsd4_revoke_export_states() has the same use-after-free as\nnfsd4_revoke_states(): it drops nn-\u003eclient_lock across\nrevoke_one_stid() and the following read of clp-\u003ecl_minorversion, but\nthe stateid reference it holds does not pin the client. A teardown\nracing the dropped lock can free the client while revoke_one_stid()\nstill dereferences it.\n\nexportfs -u drives this path through NFSD_CMD_UNLOCK_EXPORT, so an\nadministrator removing an export can race a client expiry.\n\nSkip a client that is already expiring and otherwise pin it with\ncl_rpc_users under client_lock before dropping the lock, matching\nnfsd4_revoke_states()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The UAF is in nfsd nfsd4_revoke_export_states(). A remote NFSv4 peer reaches the racing expire_client() over TCP/2049 via svc_recv to nfsd_dispatch to nfsd4_proc_compound: EXCHANGE_ID/CREATE_SESSION, SETCLIENTID_CONFIRM, or DESTROY_CLIENTID (ALLOWED_WITHOUT_FH), which free nfs4_client while the export-revoke walk still dereferences it.\nAC:L - The attacker controls the teardown side: they hold many stateids on the export so the revoke walk drops client_lock once per stid, and concurrently retry EXCHANGE_ID/CREATE_SESSION or SETCLIENTID_CONFIRM so mark_client_expired_locked() succeeds while cl_rpc_users is unpinned. The window is retryable and attacker-created.\nPR:N - EXCHANGE_ID, CREATE_SESSION, SETCLIENTID, SETCLIENTID_CONFIRM, and DESTROY_CLIENTID are ALLOWED_WITHOUT_FH with no export check. Typical AUTH_SYS/AUTH_NULL nfsd deployments do not verify RPC credentials, so any host that can reach TCP/2049 can establish state on an export and trigger expire.\nUI:N - The attacker drives the NFS compounds that create state and expire the client. Administrative exportfs -u / NFSD_CMD_UNLOCK_EXPORT is a server operational condition (unexport of the last client for a path so the filesystem can be unmounted), not a required victim user action.\nS:U - The freed object is struct nfs4_client in the NFS server kernel. Impact remains in that kernel security authority; there is no VM, IOMMU, or sandbox boundary crossing.\nC:H - revoke_one_stid() and the subsequent clp-\u003ecl_minorversion read dereference nfs4_client after free_client() kmem_cache_free\u0027s the mergeable client_slab object (KMEM_CACHE flags 0). Reclaim via EXCHANGE_ID discloses kernel memory; a UAF is C:H.\nI:H - revoke_one_stid() takes cl_lock and nfs4_put_stid() does refcount_dec_and_lock/idr_remove on the freed client\u0027s cl_lock/cl_stateids, concurrent with __destroy_client(), a slab UAF write primitive for heap corruption and control-flow hijacking.\nA:H - Use-after-free of nfs4_client in the nfsd export-revoke path oopses or panics the NFS server even without full exploitation, fully denying service of the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:51.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c05ae58fe06ce2ac34312f649e71c3596bdde358"
},
{
"url": "https://git.kernel.org/stable/c/2108de53568a64936a0da3e04d85c35df98d3fb6"
}
],
"title": "NFSD: Prevent client use-after-free during export state revocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90038",
"datePublished": "2026-09-16T10:33:37.366Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:51.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90037 (GCVE-0-2026-90037)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
NFSD: Prevent client use-after-free during close_lru reaping
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during close_lru reaping
An nfs4_openowner left on nn->close_lru after its final CLOSE keeps
its last closed stateid in oo_last_closed_stid, holding only a raw
pointer to its nfs4_client. The laundromat reaps timed-out entries,
drops nn->client_lock, and calls nfs4_put_stid(), which dereferences
the client through cl_lock. Nothing pins the client across that
window, so a concurrent force_expire_client() can free it and
nfs4_put_stid() reads freed memory. __destroy_client() hits the same
race, walking clp->cl_openowners without cl_lock.
Pin the client with cl_rpc_users before dropping client_lock, and
skip clients already expiring. __destroy_client() then cleans up its
own close_lru entries through release_last_closed_stateid(), so
teardown no longer races the laundromat.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
217526e7ecc9f6f243e976772e81eab7ab986a4c , < 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3
(git)
Affected: 217526e7ecc9f6f243e976772e81eab7ab986a4c , < e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1 (git) Affected: 217526e7ecc9f6f243e976772e81eab7ab986a4c , < 2330b788d732f43668b965b3105b37ceb276dfea (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "83dd59ac1c3455c2c7d8ddb582d980a13199b9b3",
"status": "affected",
"version": "217526e7ecc9f6f243e976772e81eab7ab986a4c",
"versionType": "git"
},
{
"lessThan": "e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1",
"status": "affected",
"version": "217526e7ecc9f6f243e976772e81eab7ab986a4c",
"versionType": "git"
},
{
"lessThan": "2330b788d732f43668b965b3105b37ceb276dfea",
"status": "affected",
"version": "217526e7ecc9f6f243e976772e81eab7ab986a4c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during close_lru reaping\n\nAn nfs4_openowner left on nn-\u003eclose_lru after its final CLOSE keeps\nits last closed stateid in oo_last_closed_stid, holding only a raw\npointer to its nfs4_client. The laundromat reaps timed-out entries,\ndrops nn-\u003eclient_lock, and calls nfs4_put_stid(), which dereferences\nthe client through cl_lock. Nothing pins the client across that\nwindow, so a concurrent force_expire_client() can free it and\nnfs4_put_stid() reads freed memory. __destroy_client() hits the same\nrace, walking clp-\u003ecl_openowners without cl_lock.\n\nPin the client with cl_rpc_users before dropping client_lock, and\nskip clients already expiring. __destroy_client() then cleans up its\nown close_lru entries through release_last_closed_stateid(), so\nteardown no longer races the laundromat."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfsd is the in-kernel NFS server. A remote NFSv4.0 client reaches the UAF over TCP/UDP 2049: CLOSE places the openowner on nn-\u003eclose_lru, and SETCLIENTID_CONFIRM (ALLOWED_WITHOUT_FH) calls expire_client() while nfs4_laundromat() drops client_lock and nfs4_put_stid() uses the unpinned nfs4_client.\nAC:L - The attacker drives both sides: OPEN/CLOSE compounds fill close_lru so the laundromat drops client_lock once per nfs4_put_stid(), and concurrent SETCLIENTID_CONFIRM with matching AUTH_SYS creds replaces the client via expire_client(). FATTR4_LEASE_TIME times the window; flooding close_lru widens it; the race is retryable.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL, so RPC uids are self-asserted. SETCLIENTID and SETCLIENTID_CONFIRM are ALLOWED_WITHOUT_FH; any host allowed by the export can OPEN/CLOSE and replace the client with no local account or capability on the NFS server.\nUI:N - The attacker issues the NFSv4.0 compounds (SETCLIENTID, OPEN, CLOSE, RENEW, SETCLIENTID_CONFIRM) itself. No administrator or other user on the victim server must mount a filesystem, write nfsdfs ctl, or otherwise interact.\nS:U - The use-after-free is of the nfsd nfs4_client object (client_slab) in the NFS server kernel. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After free_client() kmem_cache_free()s the nfs4_client, nfs4_put_stid() still reads cl_lock and cl_stateids. Reclaiming the mergeable client_slab object via further SETCLIENTID discloses kernel heap; a UAF is C:H.\nI:H - nfs4_put_stid() then takes cl_lock and idr_remove()s from cl_stateids on the freed nfs4_client, a slab UAF write concurrent with __destroy_client(). Heap reuse enables arbitrary write and control-flow hijack; a UAF is I:H.\nA:H - Use-after-free of nfs4_client in nfs4_put_stid() (spin_lock of freed cl_lock) oopses or panics the nfsd laundromat worker even without a full exploit, denying service of the NFS server host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:49.513Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/83dd59ac1c3455c2c7d8ddb582d980a13199b9b3"
},
{
"url": "https://git.kernel.org/stable/c/e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1"
},
{
"url": "https://git.kernel.org/stable/c/2330b788d732f43668b965b3105b37ceb276dfea"
}
],
"title": "NFSD: Prevent client use-after-free during close_lru reaping",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90037",
"datePublished": "2026-09-16T10:33:36.673Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:49.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90036 (GCVE-0-2026-90036)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
NFSD: Prevent client use-after-free during blocked-lock reaping
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during blocked-lock reaping
A bare lock owner -- its only remaining reference a blocked lock on
nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but
no reference keeping the client alive. When the per-net laundromat
reaps such a lock, freeing the nbl drops the owner reference
held through flc_owner, and the final nfs4_put_stateowner()
takes the client's cl_lock. Because the laundromat detaches the
nbl first, __destroy_client() no longer finds it, so a concurrent
force_expire_client() can free the client before nfs4_put_stateowner()
runs, dereferencing cl_lock in freed memory.
Pin the client with cl_rpc_users before dropping
nn->blocked_locks_lock, and skip clients already expiring, whose
blocked locks __destroy_client() frees while holding an owner
reference. Take nn->client_lock outside nn->blocked_locks_lock.
Every other site holds nn->blocked_locks_lock as a leaf, acquiring
no further lock, so placing nn->client_lock outside it cannot form
a lock-order cycle.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7919d0a27f1e7cb324e023776aa1cbff00f1ee7b , < cd489b03587378645fe0d20142a33f1ed60bac98
(git)
Affected: 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b , < 6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0 (git) Affected: 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b , < 9026932ac8be4d0ae01db47f23619a98cc57b671 (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cd489b03587378645fe0d20142a33f1ed60bac98",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
},
{
"lessThan": "6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
},
{
"lessThan": "9026932ac8be4d0ae01db47f23619a98cc57b671",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during blocked-lock reaping\n\nA bare lock owner -- its only remaining reference a blocked lock on\nnn-\u003eblocked_locks_lru -- holds a raw pointer to its nfs4_client but\nno reference keeping the client alive. When the per-net laundromat\nreaps such a lock, freeing the nbl drops the owner reference\nheld through flc_owner, and the final nfs4_put_stateowner()\ntakes the client\u0027s cl_lock. Because the laundromat detaches the\nnbl first, __destroy_client() no longer finds it, so a concurrent\nforce_expire_client() can free the client before nfs4_put_stateowner()\nruns, dereferencing cl_lock in freed memory.\n\nPin the client with cl_rpc_users before dropping\nnn-\u003eblocked_locks_lock, and skip clients already expiring, whose\nblocked locks __destroy_client() frees while holding an owner\nreference. Take nn-\u003eclient_lock outside nn-\u003eblocked_locks_lock.\nEvery other site holds nn-\u003eblocked_locks_lock as a leaf, acquiring\nno further lock, so placing nn-\u003eclient_lock outside it cannot form\na lock-order cycle."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - NFSD is the in-kernel NFS server; the UAF is reached by remote NFSv4.1 COMPOUND RPCs over TCP/UDP 2049 (EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, DESTROY_CLIENTID) that queue a blocked lock and expire the client while nfs4_laundromat() reaps it.\nAC:L - The attacker controls both sides: one client holds a conflicting lock while another queues a FILE_LOCK_DEFERRED blocked lock (bare lockowner), then DESTROY_CLIENTID races with laundromat free_blocked_lock() after nbl detach; concurrent compounds create the race and it is retryable.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with no cryptographic RPC authentication. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID (ALLOWED_WITHOUT_FH) without a local account or kernel capabilities on the server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The use-after-free is of struct nfs4_client in the NFS server kernel and does not cross a separate security authority such as a VM, guest/host, sandbox, or IOMMU boundary.\nC:H - free_blocked_lock() drops flc_owner into nfs4_put_stateowner(), which takes cl_lock on a nfs4_client already freed by concurrent expire_client(). The mergeable client_slab object (KMEM_CACHE flags 0) can be reclaimed via EXCHANGE_ID to disclose kernel memory.\nI:H - nfs4_put_stateowner() does atomic_dec_and_lock on the freed client\u0027s cl_lock and so_unhash walks client-owned lists; reclaiming the nfs4_client slab enables heap corruption and control-flow hijack. Kernel guidance scores use-after-free as I:H.\nA:H - Use-after-free of nfs4_client (spin_lock of freed cl_lock) in the laundromat worker oopses or panics the NFS server even without full exploitation, fully denying service of the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:47.831Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98"
},
{
"url": "https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0"
},
{
"url": "https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671"
}
],
"title": "NFSD: Prevent client use-after-free during blocked-lock reaping",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90036",
"datePublished": "2026-09-16T10:33:35.967Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:47.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90035 (GCVE-0-2026-90035)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
drm/amd/display: fix division by zero in get_estimated_bw()
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: fix division by zero in get_estimated_bw()
get_estimated_bw() divides by link->dpia_bw_alloc_config.bw_granularity,
which is zeroed by reset_bw_alloc_struct() and only populated once
DP_TUNNELING_BW_ALLOC_CAP_CHANGED has been handled.
link_dp_dpia_handle_bw_alloc_status(), the DPCD interrupt handler,
calls get_estimated_bw() whenever DP_TUNNELING_ESTIMATED_BW_CHANGED
is set, independently of whether DP_TUNNELING_BW_ALLOC_CAP_CHANGED
has ever fired for that link. A connected USB4/DPIA tunneling device
that reports an estimated-bandwidth change before ever reporting a
capability change drives a division by zero in this IRQ path.
link_dpia_send_bw_alloc_request() already guards the same
bw_granularity division; add the identical guard here rather than
introducing a new pattern.
(cherry picked from commit f2a961457c33dc34223aad5c9e8971de34a4eed3)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8e5cfe547bf3beeb29d9608be68d22dff2b5012b , < 4c5b61b9df6ab33b55f228e1b6579cefad11a9f7
(git)
Affected: 8e5cfe547bf3beeb29d9608be68d22dff2b5012b , < ac2ab58a79bf2401ae8c5d1c030bf0a5a376f43a (git) Affected: 8e5cfe547bf3beeb29d9608be68d22dff2b5012b , < 4814f28c45f58a71a80d09b80a60da6a063b539a (git) Affected: 8e5cfe547bf3beeb29d9608be68d22dff2b5012b , < b08c3d5ee7feadd821208f7c2c1ec02a16ce5878 (git) Affected: 8e5cfe547bf3beeb29d9608be68d22dff2b5012b , < f63de9054da858d57054474c32464106f8375e0d (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c5b61b9df6ab33b55f228e1b6579cefad11a9f7",
"status": "affected",
"version": "8e5cfe547bf3beeb29d9608be68d22dff2b5012b",
"versionType": "git"
},
{
"lessThan": "ac2ab58a79bf2401ae8c5d1c030bf0a5a376f43a",
"status": "affected",
"version": "8e5cfe547bf3beeb29d9608be68d22dff2b5012b",
"versionType": "git"
},
{
"lessThan": "4814f28c45f58a71a80d09b80a60da6a063b539a",
"status": "affected",
"version": "8e5cfe547bf3beeb29d9608be68d22dff2b5012b",
"versionType": "git"
},
{
"lessThan": "b08c3d5ee7feadd821208f7c2c1ec02a16ce5878",
"status": "affected",
"version": "8e5cfe547bf3beeb29d9608be68d22dff2b5012b",
"versionType": "git"
},
{
"lessThan": "f63de9054da858d57054474c32464106f8375e0d",
"status": "affected",
"version": "8e5cfe547bf3beeb29d9608be68d22dff2b5012b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix division by zero in get_estimated_bw()\n\nget_estimated_bw() divides by link-\u003edpia_bw_alloc_config.bw_granularity,\nwhich is zeroed by reset_bw_alloc_struct() and only populated once\nDP_TUNNELING_BW_ALLOC_CAP_CHANGED has been handled.\n\nlink_dp_dpia_handle_bw_alloc_status(), the DPCD interrupt handler,\ncalls get_estimated_bw() whenever DP_TUNNELING_ESTIMATED_BW_CHANGED\nis set, independently of whether DP_TUNNELING_BW_ALLOC_CAP_CHANGED\nhas ever fired for that link. A connected USB4/DPIA tunneling device\nthat reports an estimated-bandwidth change before ever reporting a\ncapability change drives a division by zero in this IRQ path.\n\nlink_dpia_send_bw_alloc_request() already guards the same\nbw_granularity division; add the identical guard here rather than\nintroducing a new pattern.\n\n(cherry picked from commit f2a961457c33dc34223aad5c9e8971de34a4eed3)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:35.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c5b61b9df6ab33b55f228e1b6579cefad11a9f7"
},
{
"url": "https://git.kernel.org/stable/c/ac2ab58a79bf2401ae8c5d1c030bf0a5a376f43a"
},
{
"url": "https://git.kernel.org/stable/c/4814f28c45f58a71a80d09b80a60da6a063b539a"
},
{
"url": "https://git.kernel.org/stable/c/b08c3d5ee7feadd821208f7c2c1ec02a16ce5878"
},
{
"url": "https://git.kernel.org/stable/c/f63de9054da858d57054474c32464106f8375e0d"
}
],
"title": "drm/amd/display: fix division by zero in get_estimated_bw()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90035",
"datePublished": "2026-09-16T10:33:35.281Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:35.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90034 (GCVE-0-2026-90034)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
usb: image: mdc800: change kmalloc() to kzalloc()
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: image: mdc800: change kmalloc() to kzalloc()
Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and
download_urb_buffer to kzalloc(), avoiding potential stack leaks if a
shorter message is received in mdc800_usb_irq() and
mdc800_usb_download_notify()
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6c601410d1a9ae645f604fe2f61b9f4942c77dfb
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2df8f7720ed91f1aad4f128553b6e90c7c5fac1e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 553c375e86a49882e95840565512e17bff31cc3a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8c38049879f2108f57c98f03cc7f3db51a12bdab (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 838455cc8bfe1278150d1d776529edea6cd4c1dd (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e22428f0c038c23109c0383a235aa607b0cd4c95 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2430eb81e44111b30eeb5273bbcf8b24ca517ef9 (git) Affected: 0 , < 5.10.270 (semver) Affected: 0 , < 5.15.221 (semver) Affected: 0 , < 6.1.188 (semver) Affected: 0 , < 6.6.157 (semver) Affected: 0 , < 6.12.110 (semver) Affected: 0 , < 6.18.51 (semver) Affected: 0 , < 7.2.5 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.270 , ≤ 5.10.*
(semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/image/mdc800.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c601410d1a9ae645f604fe2f61b9f4942c77dfb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2df8f7720ed91f1aad4f128553b6e90c7c5fac1e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "553c375e86a49882e95840565512e17bff31cc3a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8c38049879f2108f57c98f03cc7f3db51a12bdab",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "838455cc8bfe1278150d1d776529edea6cd4c1dd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e22428f0c038c23109c0383a235aa607b0cd4c95",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2430eb81e44111b30eeb5273bbcf8b24ca517ef9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.270",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.221",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.188",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.157",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.110",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.51",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/image/mdc800.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: image: mdc800: change kmalloc() to kzalloc()\n\nChange the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and\ndownload_urb_buffer to kzalloc(), avoiding potential stack leaks if a\nshorter message is received in mdc800_usb_irq() and\nmdc800_usb_download_notify()"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:34.586Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c601410d1a9ae645f604fe2f61b9f4942c77dfb"
},
{
"url": "https://git.kernel.org/stable/c/2df8f7720ed91f1aad4f128553b6e90c7c5fac1e"
},
{
"url": "https://git.kernel.org/stable/c/67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d"
},
{
"url": "https://git.kernel.org/stable/c/553c375e86a49882e95840565512e17bff31cc3a"
},
{
"url": "https://git.kernel.org/stable/c/8c38049879f2108f57c98f03cc7f3db51a12bdab"
},
{
"url": "https://git.kernel.org/stable/c/838455cc8bfe1278150d1d776529edea6cd4c1dd"
},
{
"url": "https://git.kernel.org/stable/c/e22428f0c038c23109c0383a235aa607b0cd4c95"
},
{
"url": "https://git.kernel.org/stable/c/2430eb81e44111b30eeb5273bbcf8b24ca517ef9"
}
],
"title": "usb: image: mdc800: change kmalloc() to kzalloc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90034",
"datePublished": "2026-09-16T10:33:34.586Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:34.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90033 (GCVE-0-2026-90033)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
The snd_usbmidi_us122l_output() picks a count of 2 on anything slower
than high speed and never relates it to ep->max_transfer. The URB
buffer holds exactly max_transfer bytes, so a device declaring a one
byte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the
memset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.
Only 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at
0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the
USB core only clamps downward.
The akai and novation output ops in this file were given the same guard
recently. Do the same here.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
030a07e441296c372f946cd4065b5d831d8dc40c , < 5538daf2a5cc80ac3f3e913c0db045d92d995d40
(git)
Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < a441a8e52148c91c2f2a91f42e3b9bc961a13a4b (git) Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < 2dae0e3a59e31f78222279d544b98e747cd1fbff (git) Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < 1d4add2b832b56f81bb0eab065ec35c610343018 (git) Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < de6d252f115be887a701c09a05cdb076f3a590c9 (git) Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < 9392a2c346762ffee8edd1ba8bac50d2e24a2ed7 (git) Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < 9d81885d97cba7796d1f8edc88f2499c8296f5b9 (git) Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < e4637ce34607f1733a34a57294966d26b263e626 (git) |
|
| Linux | Linux |
Affected:
2.6.28
Unaffected: 0 , < 2.6.28 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5538daf2a5cc80ac3f3e913c0db045d92d995d40",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
},
{
"lessThan": "a441a8e52148c91c2f2a91f42e3b9bc961a13a4b",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
},
{
"lessThan": "2dae0e3a59e31f78222279d544b98e747cd1fbff",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
},
{
"lessThan": "1d4add2b832b56f81bb0eab065ec35c610343018",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
},
{
"lessThan": "de6d252f115be887a701c09a05cdb076f3a590c9",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
},
{
"lessThan": "9392a2c346762ffee8edd1ba8bac50d2e24a2ed7",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
},
{
"lessThan": "9d81885d97cba7796d1f8edc88f2499c8296f5b9",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
},
{
"lessThan": "e4637ce34607f1733a34a57294966d26b263e626",
"status": "affected",
"version": "030a07e441296c372f946cd4065b5d831d8dc40c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()\n\nThe snd_usbmidi_us122l_output() picks a count of 2 on anything slower\nthan high speed and never relates it to ep-\u003emax_transfer. The URB\nbuffer holds exactly max_transfer bytes, so a device declaring a one\nbyte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the\nmemset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.\n\nOnly 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at\n0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the\nUSB core only clamps downward.\n\nThe akai and novation output ops in this file were given the same guard\nrecently. Do the same here."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:33.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5538daf2a5cc80ac3f3e913c0db045d92d995d40"
},
{
"url": "https://git.kernel.org/stable/c/a441a8e52148c91c2f2a91f42e3b9bc961a13a4b"
},
{
"url": "https://git.kernel.org/stable/c/2dae0e3a59e31f78222279d544b98e747cd1fbff"
},
{
"url": "https://git.kernel.org/stable/c/1d4add2b832b56f81bb0eab065ec35c610343018"
},
{
"url": "https://git.kernel.org/stable/c/de6d252f115be887a701c09a05cdb076f3a590c9"
},
{
"url": "https://git.kernel.org/stable/c/9392a2c346762ffee8edd1ba8bac50d2e24a2ed7"
},
{
"url": "https://git.kernel.org/stable/c/9d81885d97cba7796d1f8edc88f2499c8296f5b9"
},
{
"url": "https://git.kernel.org/stable/c/e4637ce34607f1733a34a57294966d26b263e626"
}
],
"title": "ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90033",
"datePublished": "2026-09-16T10:33:33.899Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:33.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90032 (GCVE-0-2026-90032)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
media: usbtv: keep device alive while ALSA card exists
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: usbtv: keep device alive while ALSA card exists
The ALSA PCM callbacks store the driver state in pcm->private_data. An
open PCM file can outlive USB disconnect because usbtv_audio_free() uses
snd_card_free_when_closed(). The disconnect path can then drop the V4L2
device reference and free struct usbtv before ALSA releases the substream,
so a later close dereferences freed memory in snd_usbtv_pcm_close().
Take a V4L2 device reference for the ALSA card and drop it from the card
private_free callback. This keeps struct usbtv valid until ALSA has closed
the remaining files and freed the card.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
63ddf68de52efaac40a9287e44266ac30e71dd36 , < 97b5e8b22b98e287481a97a9a4cfebbb348738a5
(git)
Affected: 63ddf68de52efaac40a9287e44266ac30e71dd36 , < 503be26ff888cb3576e55d251895d290e8146f27 (git) Affected: 63ddf68de52efaac40a9287e44266ac30e71dd36 , < be0f7745f883386e5263b4e475686a81dfa87175 (git) Affected: 63ddf68de52efaac40a9287e44266ac30e71dd36 , < 67374e3a00814dcdd46e9feca61f69f7f2d81957 (git) Affected: 63ddf68de52efaac40a9287e44266ac30e71dd36 , < 239d1683e08b2aee2a15ef35706e1ea9a76681d8 (git) Affected: 63ddf68de52efaac40a9287e44266ac30e71dd36 , < 7690a86b193271322cd31ab77349a87aa10858e4 (git) Affected: 63ddf68de52efaac40a9287e44266ac30e71dd36 , < 1618257cb0aba4ce342ae8c0228368c24161f5fb (git) Affected: 63ddf68de52efaac40a9287e44266ac30e71dd36 , < fc530fe168bb2b745a93f553ad21fc25fd9cba3d (git) |
|
| Linux | Linux |
Affected:
3.18
Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/usbtv/usbtv-audio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "97b5e8b22b98e287481a97a9a4cfebbb348738a5",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
},
{
"lessThan": "503be26ff888cb3576e55d251895d290e8146f27",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
},
{
"lessThan": "be0f7745f883386e5263b4e475686a81dfa87175",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
},
{
"lessThan": "67374e3a00814dcdd46e9feca61f69f7f2d81957",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
},
{
"lessThan": "239d1683e08b2aee2a15ef35706e1ea9a76681d8",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
},
{
"lessThan": "7690a86b193271322cd31ab77349a87aa10858e4",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
},
{
"lessThan": "1618257cb0aba4ce342ae8c0228368c24161f5fb",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
},
{
"lessThan": "fc530fe168bb2b745a93f553ad21fc25fd9cba3d",
"status": "affected",
"version": "63ddf68de52efaac40a9287e44266ac30e71dd36",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/usbtv/usbtv-audio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: usbtv: keep device alive while ALSA card exists\n\nThe ALSA PCM callbacks store the driver state in pcm-\u003eprivate_data. An\nopen PCM file can outlive USB disconnect because usbtv_audio_free() uses\nsnd_card_free_when_closed(). The disconnect path can then drop the V4L2\ndevice reference and free struct usbtv before ALSA releases the substream,\nso a later close dereferences freed memory in snd_usbtv_pcm_close().\n\nTake a V4L2 device reference for the ALSA card and drop it from the card\nprivate_free callback. This keeps struct usbtv valid until ALSA has closed\nthe remaining files and freed the card."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached locally by opening the usbtv ALSA capture PCM, forcing usbtv_disconnect() via USBDEVFS_DISCONNECT or sysfs unbind on an already-bound USBTV007, then closing the PCM fd; there is no network or packet path. This matches AV:L scoring of analogous USB disconnect UAFs (CVE-2026-80971, CVE-2026-64585); physical unplug is only an extra path.\nAC:L - The attacker fully controls the sequence: open /dev/snd/pcmC*D*c so PCM callbacks pin pcm-\u003eprivate_data, issue USBDEVFS_DISCONNECT so snd_card_free_when_closed() returns without waiting, then close. That close deterministically hits freed struct usbtv in snd_usbtv_pcm_close(); no attacker-uncontrollable race or layout is required.\nPR:L - USBDEVFS_DISCONNECT has no capable() check, only write access to /dev/bus/usb that udev uaccess/plugdev rules grant seat users, and snd_pcm_open() has no capability gate on the capture PCM node (audio group/uaccess). An unprivileged local account suffices; init-namespace root is not required.\nUI:N - The attacker performs open, disconnect, and close on their own fds against an already-attached USBTV007 (capture kiosk, digitizer, or surveillance station). No separate victim action such as plugging a device or clicking is required during exploitation.\nS:U - The slab use-after-free of struct usbtv and the PCM close/trigger callbacks run entirely in the host kernel. This is ordinary local privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - snd_usbtv_pcm_close() and snd_usbtv_card_trigger() read fields of the kfree()\u0027d struct usbtv (snd_stream, snd_trigger, snd_bulk_urb). Reclaiming that slab lets the attacker supply pointer-rich state those paths then read, enabling kernel disclosure as with other heap UAFs.\nI:H - Close can atomic_set snd_stream and schedule_work() on the freed usbtv.snd_trigger work_struct, and snd_pcm_drop may call trigger STOP on the same freed object. A reclaimed fake usbtv plus workqueue execution is a control-flow hijack primitive, so integrity impact is High.\nA:H - Use-after-free of struct usbtv in snd_usbtv_pcm_close() (and in usbtv_audio_urb_received if capture was running when USB core kills the URB after disconnect) oopses or panics the kernel. The attacker can repeat disconnect/close to crash on demand, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:46.318Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/97b5e8b22b98e287481a97a9a4cfebbb348738a5"
},
{
"url": "https://git.kernel.org/stable/c/503be26ff888cb3576e55d251895d290e8146f27"
},
{
"url": "https://git.kernel.org/stable/c/be0f7745f883386e5263b4e475686a81dfa87175"
},
{
"url": "https://git.kernel.org/stable/c/67374e3a00814dcdd46e9feca61f69f7f2d81957"
},
{
"url": "https://git.kernel.org/stable/c/239d1683e08b2aee2a15ef35706e1ea9a76681d8"
},
{
"url": "https://git.kernel.org/stable/c/7690a86b193271322cd31ab77349a87aa10858e4"
},
{
"url": "https://git.kernel.org/stable/c/1618257cb0aba4ce342ae8c0228368c24161f5fb"
},
{
"url": "https://git.kernel.org/stable/c/fc530fe168bb2b745a93f553ad21fc25fd9cba3d"
}
],
"title": "media: usbtv: keep device alive while ALSA card exists",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90032",
"datePublished": "2026-09-16T10:33:33.197Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:46.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90031 (GCVE-0-2026-90031)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
usb-storage: ene_ub6250: fix race between scan work and probe
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb-storage: ene_ub6250: fix race between scan work and probe
ene_ub6250_probe() calls usb_stor_probe2(), which starts the usb-storage
infrastructure and schedules the delayed scan work. The driver then
calls ene_get_card_type(), which sends an ENE command through
ene_send_scsi_cmd() and the usb-storage bulk transfer helpers.
Both the delayed scan work, through usb_stor_Bulk_max_lun(), and
ene_get_card_type() use us->current_urb. The scan work serializes this
access with us->dev_mutex, but the ENE card-type probe does not. If the
scan work runs while ene_get_card_type() is still using us->current_urb,
usb_submit_urb() warns that the URB is already active.
Serialize ene_get_card_type() with us->dev_mutex, matching the locking
used by the scan path.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9cd335f4f41e84d1ab88d80150ffee8dee9650d7
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8936d95dd04d34db96d4d1e3899eee52605bbedc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9c261a83131e241d67cb73ab578d0265bc19cfb5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9481bc04a8c351ed883a7f0e10939bbe9120ead7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5082546702c32a2700894d2c0ace784e038ef6a3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1c67f2ba9c5f7c5ab3670671c0d51c6504bcaf74 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 996c319b8bd5ada1f62daae0d331d0b23e0f2117 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 445fc368c6bc73eff0aeb3818cf5f355facfbb16 (git) Affected: 0 , < 5.10.270 (semver) Affected: 0 , < 5.15.221 (semver) Affected: 0 , < 6.1.188 (semver) Affected: 0 , < 6.6.157 (semver) Affected: 0 , < 6.12.110 (semver) Affected: 0 , < 6.18.51 (semver) Affected: 0 , < 7.2.5 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.270 , ≤ 5.10.*
(semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/ene_ub6250.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9cd335f4f41e84d1ab88d80150ffee8dee9650d7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8936d95dd04d34db96d4d1e3899eee52605bbedc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9c261a83131e241d67cb73ab578d0265bc19cfb5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9481bc04a8c351ed883a7f0e10939bbe9120ead7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5082546702c32a2700894d2c0ace784e038ef6a3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1c67f2ba9c5f7c5ab3670671c0d51c6504bcaf74",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "996c319b8bd5ada1f62daae0d331d0b23e0f2117",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "445fc368c6bc73eff0aeb3818cf5f355facfbb16",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.270",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.221",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.188",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.157",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.110",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.51",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/ene_ub6250.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb-storage: ene_ub6250: fix race between scan work and probe\n\nene_ub6250_probe() calls usb_stor_probe2(), which starts the usb-storage\ninfrastructure and schedules the delayed scan work. The driver then\ncalls ene_get_card_type(), which sends an ENE command through\nene_send_scsi_cmd() and the usb-storage bulk transfer helpers.\n\nBoth the delayed scan work, through usb_stor_Bulk_max_lun(), and\nene_get_card_type() use us-\u003ecurrent_urb. The scan work serializes this\naccess with us-\u003edev_mutex, but the ENE card-type probe does not. If the\nscan work runs while ene_get_card_type() is still using us-\u003ecurrent_urb,\nusb_submit_urb() warns that the URB is already active.\n\nSerialize ene_get_card_type() with us-\u003edev_mutex, matching the locking\nused by the scan path."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:32.524Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9cd335f4f41e84d1ab88d80150ffee8dee9650d7"
},
{
"url": "https://git.kernel.org/stable/c/8936d95dd04d34db96d4d1e3899eee52605bbedc"
},
{
"url": "https://git.kernel.org/stable/c/9c261a83131e241d67cb73ab578d0265bc19cfb5"
},
{
"url": "https://git.kernel.org/stable/c/9481bc04a8c351ed883a7f0e10939bbe9120ead7"
},
{
"url": "https://git.kernel.org/stable/c/5082546702c32a2700894d2c0ace784e038ef6a3"
},
{
"url": "https://git.kernel.org/stable/c/1c67f2ba9c5f7c5ab3670671c0d51c6504bcaf74"
},
{
"url": "https://git.kernel.org/stable/c/996c319b8bd5ada1f62daae0d331d0b23e0f2117"
},
{
"url": "https://git.kernel.org/stable/c/445fc368c6bc73eff0aeb3818cf5f355facfbb16"
}
],
"title": "usb-storage: ene_ub6250: fix race between scan work and probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90031",
"datePublished": "2026-09-16T10:33:32.524Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:32.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90030 (GCVE-0-2026-90030)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
usb: dwc3: clear forceRM when issuing EndTransfer
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: clear forceRM when issuing EndTransfer
The forceRM bit of the DEPCMD register controls the behavior of the
EndTransfer command used to stop an active transfer. Older DWC3
programming guide revisions recommended setting forceRM=1 when
issuing EndTransfer. Newer programming guide revisions recommend
issuing EndTransfer with forceRM cleared.
With forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer
aborted through the ep_dequeue path was observed to remain active
after EndTransfer completion. A subsequent StartTransfer issued on the
same endpoint triggered writes associated with the aborted transfer.
This resulted in an SMMU fault because the transfer buffer had already
been unmapped during EndTransfer command-completion cleanup.
Using forceRM=0 eliminates the issue. Although older DWC3 programming
guide revisions recommended setting forceRM=1, no issues are known
from using forceRM=0. Clear forceRM when issuing EndTransfer to provide
consistent EndTransfer behavior and align with newer programming guide
recommendations.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1e43c86d84fb0503e82a143e017f35421498fc1a , < 0afe5c31612de3d18cc6d16e616da4a48ba1e5a2
(git)
Affected: 1e43c86d84fb0503e82a143e017f35421498fc1a , < e01408ee52fe5cb2d0b43f47f359336af2b6c316 (git) Affected: 1e43c86d84fb0503e82a143e017f35421498fc1a , < b58e6200450d350314db0ecda7d6d1bde3281e80 (git) Affected: ab99c4be945724b032cc55e05c6738fe1d84bf70 (git) Affected: 6.6.37 , < 6.7 (semver) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0afe5c31612de3d18cc6d16e616da4a48ba1e5a2",
"status": "affected",
"version": "1e43c86d84fb0503e82a143e017f35421498fc1a",
"versionType": "git"
},
{
"lessThan": "e01408ee52fe5cb2d0b43f47f359336af2b6c316",
"status": "affected",
"version": "1e43c86d84fb0503e82a143e017f35421498fc1a",
"versionType": "git"
},
{
"lessThan": "b58e6200450d350314db0ecda7d6d1bde3281e80",
"status": "affected",
"version": "1e43c86d84fb0503e82a143e017f35421498fc1a",
"versionType": "git"
},
{
"status": "affected",
"version": "ab99c4be945724b032cc55e05c6738fe1d84bf70",
"versionType": "git"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.37",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: clear forceRM when issuing EndTransfer\n\nThe forceRM bit of the DEPCMD register controls the behavior of the\nEndTransfer command used to stop an active transfer. Older DWC3\nprogramming guide revisions recommended setting forceRM=1 when\nissuing EndTransfer. Newer programming guide revisions recommend\nissuing EndTransfer with forceRM cleared.\n\nWith forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer\naborted through the ep_dequeue path was observed to remain active\nafter EndTransfer completion. A subsequent StartTransfer issued on the\nsame endpoint triggered writes associated with the aborted transfer.\nThis resulted in an SMMU fault because the transfer buffer had already\nbeen unmapped during EndTransfer command-completion cleanup.\n\nUsing forceRM=0 eliminates the issue. Although older DWC3 programming\nguide revisions recommended setting forceRM=1, no issues are known\nfrom using forceRM=0. Clear forceRM when issuing EndTransfer to provide\nconsistent EndTransfer behavior and align with newer programming guide\nrecommendations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The documented trigger is dwc3_gadget_ep_dequeue(), reached from FunctionFS via usb_ep_dequeue() on ordinary local syscalls (interrupted read, aio_cancel, close, FUNCTIONFS_DMABUF_DETACH) rather than USB host packet parsing; this matches AV:L used for other f_fs/dwc3 EndXfer bugs (CVE-2024-36977, CVE-2024-36894).\nAC:L - On affected DWC_usb31 controllers the attacker deterministically queues a request, dequeues it so EndTransfer runs with forceRM=1, then queues again so StartTransfer replays DMA to the already-unmapped buffer; no uncontrolled race is involved, and v2.00a/v2.10a hardware is common on Qualcomm phones and embedded boards.\nPR:L - FunctionFS endpoint nodes are routinely delegated to unprivileged gadget daemons (adbd/shell, MTP) via uid=/gid=/fmode=; queue, cancel, and re-queue are ordinary file operations and the dequeue path performs no capability check.\nUI:N - The attacking process performs the queue, dequeue, and re-queue itself; a USB cable being attached is an ambient condition of phones, kiosks, and embedded gadgets, not a separate victim action the attacker must induce.\nS:U - Stale controller DMA targets the transfer buffer the gadget had already mapped in the same kernel; this is not a VM escape or IOMMU-domain bypass, and an SMMU, when present, faults the access rather than being circumvented.\nC:H - The same EndTransfer forceRM mishandling applies to IN endpoints, so after unmap the still-active transfer can DMA-read reused pages onto the USB bus; per kernel UAF guidance this memory-corruption primitive also yields kernel disclosure once backing pages are reallocated.\nI:H - The issue was reproduced as stale DMA writes on an OUT bulk endpoint into a buffer already unmapped during EndTransfer completion cleanup, so leftover or host-supplied data is written into reallocated kernel pages, a DMA use-after-free write primitive suitable for control-flow hijacking.\nA:H - The commit reports an SMMU fault when the controller accesses the already-unmapped transfer buffer, which panics or wedges the USB/IOMMU path; without an IOMMU the same DMA use-after-free likewise oopses or panics the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:44.818Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0afe5c31612de3d18cc6d16e616da4a48ba1e5a2"
},
{
"url": "https://git.kernel.org/stable/c/e01408ee52fe5cb2d0b43f47f359336af2b6c316"
},
{
"url": "https://git.kernel.org/stable/c/b58e6200450d350314db0ecda7d6d1bde3281e80"
}
],
"title": "usb: dwc3: clear forceRM when issuing EndTransfer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90030",
"datePublished": "2026-09-16T10:33:31.801Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:44.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90029 (GCVE-0-2026-90029)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
usb: storage: realtek_cr: fix use-after-free on disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: realtek_cr: fix use-after-free on disconnect
realtek_cr_destructor() calls timer_delete() before the chip containing
the timer is freed. The timer callback may still be running and can
rearm itself, resulting in a use-after-free.
Use timer_shutdown_sync() to wait for the callback and prevent further
rearming. Do this unconditionally because ss_en may be changed after
the timer is armed.
Move timer_setup() into init_realtek_cr() so the timer is initialized
before any failure path can invoke the destructor.
Found by static analysis.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e931830bb877e2aad9a1be83506f9bdb26c91e4e , < 7c4e2f964c65dea4ea22386799d5fb10ef1e3e54
(git)
Affected: e931830bb877e2aad9a1be83506f9bdb26c91e4e , < cae9dbba6adae21a04a3bd045e07b489847ff2c6 (git) Affected: e931830bb877e2aad9a1be83506f9bdb26c91e4e , < 4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc (git) |
|
| Linux | Linux |
Affected:
3.1
Unaffected: 0 , < 3.1 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/realtek_cr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c4e2f964c65dea4ea22386799d5fb10ef1e3e54",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
},
{
"lessThan": "cae9dbba6adae21a04a3bd045e07b489847ff2c6",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
},
{
"lessThan": "4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/realtek_cr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: realtek_cr: fix use-after-free on disconnect\n\nrealtek_cr_destructor() calls timer_delete() before the chip containing\nthe timer is freed. The timer callback may still be running and can\nrearm itself, resulting in a use-after-free.\n\nUse timer_shutdown_sync() to wait for the callback and prevent further\nrearming. Do this unconditionally because ss_en may be changed after\nthe timer is armed.\n\nMove timer_setup() into init_realtek_cr() so the timer is initialized\nbefore any failure path can invoke the destructor.\n\nFound by static analysis."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:31.117Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c4e2f964c65dea4ea22386799d5fb10ef1e3e54"
},
{
"url": "https://git.kernel.org/stable/c/cae9dbba6adae21a04a3bd045e07b489847ff2c6"
},
{
"url": "https://git.kernel.org/stable/c/4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc"
}
],
"title": "usb: storage: realtek_cr: fix use-after-free on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90029",
"datePublished": "2026-09-16T10:33:31.117Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:31.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90028 (GCVE-0-2026-90028)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
usb: typec: hd3ss3220: track VBUS enable state per consumer
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: hd3ss3220: track VBUS enable state per consumer
regulator_is_enabled() reports the aggregate regulator state, not
whether this consumer holds an enable reference. If another consumer
enables VBUS first, the driver can skip its own regulator_enable() call
and later attempt to drop a reference it never acquired, triggering an
unbalanced regulator disable warning.
Track successful enable and disable calls locally. Keep the state
unchanged when an operation fails so a later role or ID notification
retries the operation while this consumer keeps balanced references.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b3f9d6e491fda73c319547881b78cdd2a222b293 , < df7cd3908e07503fa7e9737dacf44208530e58d9
(git)
Affected: b3f9d6e491fda73c319547881b78cdd2a222b293 , < c9a48db776d7184981630ecc01a3ad30a8f7dc24 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/hd3ss3220.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "df7cd3908e07503fa7e9737dacf44208530e58d9",
"status": "affected",
"version": "b3f9d6e491fda73c319547881b78cdd2a222b293",
"versionType": "git"
},
{
"lessThan": "c9a48db776d7184981630ecc01a3ad30a8f7dc24",
"status": "affected",
"version": "b3f9d6e491fda73c319547881b78cdd2a222b293",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/hd3ss3220.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: hd3ss3220: track VBUS enable state per consumer\n\nregulator_is_enabled() reports the aggregate regulator state, not\nwhether this consumer holds an enable reference. If another consumer\nenables VBUS first, the driver can skip its own regulator_enable() call\nand later attempt to drop a reference it never acquired, triggering an\nunbalanced regulator disable warning.\n\nTrack successful enable and disable calls locally. Keep the state\nunchanged when an operation fails so a later role or ID notification\nretries the operation while this consumer keeps balanced references."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:30.400Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/df7cd3908e07503fa7e9737dacf44208530e58d9"
},
{
"url": "https://git.kernel.org/stable/c/c9a48db776d7184981630ecc01a3ad30a8f7dc24"
}
],
"title": "usb: typec: hd3ss3220: track VBUS enable state per consumer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90028",
"datePublished": "2026-09-16T10:33:30.400Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:30.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90027 (GCVE-0-2026-90027)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
cc_debounce_dwork is queued from the set_cc() and start_toggling()
callbacks, which run from TCPM's kthread worker. port_stop() returns
before tcpm_unregister_port() destroys that worker. Flushing the worker
during unregister may therefore run a callback which queues the delayed
work after port_stop() has returned.
The delayed work can then run after devres has freed pmic_typec_port.
Use disable_delayed_work_sync() in port_stop() to cancel a pending
instance and prevent the TCPM callbacks from queueing another one.
This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a4422ff221429c600c3dc5d0394fb3738b89d040 , < 4359b5f95c93a4658e08368fa6fab9d89eb98447
(git)
Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < c614d7c44ca7fb78867ba46b233acdb59287e8c8 (git) Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < 1ab669c2b44e1040ddfab7cd7f717aad580d17aa (git) Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < 263f7d61a4201cde16849b2d016251806e7418be (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4359b5f95c93a4658e08368fa6fab9d89eb98447",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "c614d7c44ca7fb78867ba46b233acdb59287e8c8",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "1ab669c2b44e1040ddfab7cd7f717aad580d17aa",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "263f7d61a4201cde16849b2d016251806e7418be",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop\n\ncc_debounce_dwork is queued from the set_cc() and start_toggling()\ncallbacks, which run from TCPM\u0027s kthread worker. port_stop() returns\nbefore tcpm_unregister_port() destroys that worker. Flushing the worker\nduring unregister may therefore run a callback which queues the delayed\nwork after port_stop() has returned.\n\nThe delayed work can then run after devres has freed pmic_typec_port.\n\nUse disable_delayed_work_sync() in port_stop() to cancel a pending\ninstance and prevent the TCPM callbacks from queueing another one.\n\nThis issue was found by an in-house static analysis tool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The use-after-free is reached on Qualcomm PMIC Type-C platform-driver teardown (sysfs unbind, rmmod, or probe-error unwind after TCPM is registered), not by parsing USB-C/PD traffic from a plugged partner. That matches other USB gadget/UDC and onboard Type-C teardown UAFs scored Local and is higher severity than Physical.\nAC:L - An attacker who initiates remove controls both sides: TCPM set_cc/start_toggling queue the 2ms cc_debounce_dwork, and kthread_destroy_worker() in tcpm_unregister_port() can run those callbacks after port_stop() returns, re-queueing work that then runs after devres frees pmic_typec_port. Use-after-free bugs are AC:L unless the attacker cannot influence the race.\nPR:L - Highest reasonable exposure is a local account on Qualcomm phones, automotive, and embedded boards that manage the Type-C/USB stack, where platform unbind or USB HAL access is often delegated beyond init-namespace root. Uncertain Low versus High, so Low per the overestimate rule.\nUI:N - The attacker initiates driver unbind, module unload, or a failing re-probe themselves; no separate victim action such as plugging a USB-C cable, mounting a filesystem, or opening a device node is required.\nS:U - The use-after-free corrupts the host kernel pmic_typec_port heap object within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - qcom_pmic_typec_port_cc_debounce() recovers the freed pmic_typec_port via container_of and reads its spinlock and device pointer; per CNA guidance a use-after-free enables arbitrary kernel memory disclosure.\nI:H - The same delayed work writes debouncing_cc and performs spin_lock/unlock on the freed object, and the pending delayed_work lives inside pmic_typec_port, so heap spray yields an arbitrary write or workqueue function-pointer hijack.\nA:H - Use-after-free of pmic_typec_port from system-wq delayed work after remove causes a kernel oops or panic even without a full exploit, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:43.363Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4359b5f95c93a4658e08368fa6fab9d89eb98447"
},
{
"url": "https://git.kernel.org/stable/c/c614d7c44ca7fb78867ba46b233acdb59287e8c8"
},
{
"url": "https://git.kernel.org/stable/c/1ab669c2b44e1040ddfab7cd7f717aad580d17aa"
},
{
"url": "https://git.kernel.org/stable/c/263f7d61a4201cde16849b2d016251806e7418be"
}
],
"title": "usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90027",
"datePublished": "2026-09-16T10:33:29.700Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:43.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90026 (GCVE-0-2026-90026)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
usb: typec: qcom-pmic: cancel reset_work on stop
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: qcom-pmic: cancel reset_work on stop
pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ
handler schedules it just before disable_irq(), the work runs after
remove() frees the struct via devm.
Call cancel_work_sync() after disabling IRQs to close the window.
This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a4422ff221429c600c3dc5d0394fb3738b89d040 , < 0b69b166852dbf1f9532b22bd49f502e5970eb95
(git)
Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < b9a7eed472edbfa8dec0fdeafd5e796550a8a8b7 (git) Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < d4e00a1eb39174e25ef759b8fb1111bba8e87b1e (git) Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < 52d556f08547733948cc40b8b11e6b68dccee7b2 (git) Affected: a4422ff221429c600c3dc5d0394fb3738b89d040 , < 7b0df6efd143f8085bdb68778a013a46f1349913 (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0b69b166852dbf1f9532b22bd49f502e5970eb95",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "b9a7eed472edbfa8dec0fdeafd5e796550a8a8b7",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "d4e00a1eb39174e25ef759b8fb1111bba8e87b1e",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "52d556f08547733948cc40b8b11e6b68dccee7b2",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
},
{
"lessThan": "7b0df6efd143f8085bdb68778a013a46f1349913",
"status": "affected",
"version": "a4422ff221429c600c3dc5d0394fb3738b89d040",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: qcom-pmic: cancel reset_work on stop\n\npdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ\nhandler schedules it just before disable_irq(), the work runs after\nremove() frees the struct via devm.\n\nCall cancel_work_sync() after disabling IRQs to close the window.\n\nThis issue was found by an in-house static analysis tool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The use-after-free is reached from local Qualcomm PMIC Type-C platform-driver teardown (sysfs unbind, rmmod, or probe unwind calling pdphy_stop), not from parsing USB host packets. That matches other USB/UDC teardown UAFs scored Local and is higher severity than Physical.\nAC:L - A USB PD Hard Reset SIG_RX IRQ schedules reset_work, then pdphy_stop() only disable_irq() without cancel_work_sync, so the attacker can queue the work and immediately unbind/rebind until the worker runs on the freed pmic_typec_pdphy; such attacker-driven UAF races score AC:L.\nPR:L - Per CNA driver-removal UAF precedent, an unprivileged local user on Qualcomm phones, laptops, and automotive systems using this PMIC Type-C controller can spray the freed pmic_typec_pdphy while privileged or automated teardown proceeds; init-namespace root is not required for the UAF itself.\nUI:N - The attacker queues reset_work from in-flight SIG_RX and initiates driver removal themselves; no separate victim action such as plugging a USB cable, mounting a filesystem, or opening a device node is required.\nS:U - The use-after-free corrupts the host kernel\u0027s pmic_typec_pdphy and tcpm_port heap objects within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - qcom_pmic_typec_pdphy_sig_reset_work() recovers the freed pmic_typec_pdphy via container_of and reads its lock, regmap, and tcpm_port; reclaiming that slab yields a classic UAF read/disclosure primitive.\nI:H - The dangling worker takes the freed lock, writes PD PHY registers through regmap, and calls tcpm_pd_hard_reset() on a possibly unregistered port, enabling heap corruption and control-flow hijack.\nA:H - Dereferencing the freed pmic_typec_pdphy from workqueue context, or queueing TCPM work on a destroyed port worker, causes a kernel oops or panic even without a full exploit, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:41.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b69b166852dbf1f9532b22bd49f502e5970eb95"
},
{
"url": "https://git.kernel.org/stable/c/b9a7eed472edbfa8dec0fdeafd5e796550a8a8b7"
},
{
"url": "https://git.kernel.org/stable/c/d4e00a1eb39174e25ef759b8fb1111bba8e87b1e"
},
{
"url": "https://git.kernel.org/stable/c/52d556f08547733948cc40b8b11e6b68dccee7b2"
},
{
"url": "https://git.kernel.org/stable/c/7b0df6efd143f8085bdb68778a013a46f1349913"
}
],
"title": "usb: typec: qcom-pmic: cancel reset_work on stop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90026",
"datePublished": "2026-09-16T10:33:29.008Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:41.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90025 (GCVE-0-2026-90025)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
usb: typec: ucsi: displayport: Fix OOB altmode array index
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: displayport: Fix OOB altmode array index
The UCSI displayport driver indexes the connector's port altmode array
with the GET_CURRENT_CAM response after checking it is not 0xff. The
port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM
returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and
not equal to 0xff, the kernel may crash with an array index OOB error.
Update the UCSI displayport driver to verify the current cam is less
than UCSI_MAX_ALTMODES before accessing the port altmode array.
Severity
7.7 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
af8622f6a585d8d82b11cd7987e082861fd0edd3 , < 8fde7e4a366184e9a6aa95541e52933a73c00a74
(git)
Affected: af8622f6a585d8d82b11cd7987e082861fd0edd3 , < 83f1abd62cc134700ba92e1e2dc650a49a185497 (git) Affected: af8622f6a585d8d82b11cd7987e082861fd0edd3 , < 1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456 (git) Affected: af8622f6a585d8d82b11cd7987e082861fd0edd3 , < 58e0ee293ec5e06cacbe3953ad44042f1473dae9 (git) Affected: af8622f6a585d8d82b11cd7987e082861fd0edd3 , < ac9f878c468052af6571e8639ab1c3ae040b908f (git) Affected: af8622f6a585d8d82b11cd7987e082861fd0edd3 , < 33a81acd2d1d0667d4eff93cb90339fa53e617e8 (git) Affected: af8622f6a585d8d82b11cd7987e082861fd0edd3 , < bdaaf3074aedce8f1b173cc363d61cff5f6a585f (git) Affected: af8622f6a585d8d82b11cd7987e082861fd0edd3 , < 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/displayport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8fde7e4a366184e9a6aa95541e52933a73c00a74",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
},
{
"lessThan": "83f1abd62cc134700ba92e1e2dc650a49a185497",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
},
{
"lessThan": "1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
},
{
"lessThan": "58e0ee293ec5e06cacbe3953ad44042f1473dae9",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
},
{
"lessThan": "ac9f878c468052af6571e8639ab1c3ae040b908f",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
},
{
"lessThan": "33a81acd2d1d0667d4eff93cb90339fa53e617e8",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
},
{
"lessThan": "bdaaf3074aedce8f1b173cc363d61cff5f6a585f",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
},
{
"lessThan": "04cec690b1fd9d1c4c314b91a10d8c68a3acfe18",
"status": "affected",
"version": "af8622f6a585d8d82b11cd7987e082861fd0edd3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/displayport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix OOB altmode array index\n\nThe UCSI displayport driver indexes the connector\u0027s port altmode array\nwith the GET_CURRENT_CAM response after checking it is not 0xff. The\nport altmode array is UCSI_MAX_ALTMODES elements long. If the PPM\nreturns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and\nnot equal to 0xff, the kernel may crash with an array index OOB error.\n\nUpdate the UCSI displayport driver to verify the current cam is less\nthan UCSI_MAX_ALTMODES before accessing the port altmode array."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The OOB index is the PPM GET_CURRENT_CAM byte from onboard UCSI firmware (ACPI EC, I2C CCG/STM32G0, pmic_glink, Chrome OS EC), not a USB-C partner or network packet. A compromised PPM can report CONNECTED plus DP partner altmodes and drive enter without a physical plug, matching other firmware-to-kernel scores.\nAC:L - The PPM fully controls the GET_CURRENT_CAM u8; any value in 30-254 (UCSI_MAX_ALTMODES is 30, 0xff is the only sentinel) deterministically indexes port_altmode[] out of bounds with no race or attacker-uncontrollable layout.\nPR:N - UCSI connector-change work, GET_CURRENT_CAM, and dp_altmode_probe\u0027s automatic enter run in kernel context from PPM notifications with no capable() or credential check, so compromised PPM/EC firmware needs no host account.\nUI:N - Partner registration and DisplayPort altmode enter run automatically from PPM connector-change events and dp_altmode_probe scheduled work; no victim must plug a cable, mount media, or open a device node.\nS:U - The out-of-bounds pointer load stays inside the host kernel UCSI DisplayPort driver and connector heap; it does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - cur is a full u8 used as an index into port_altmode[UCSI_MAX_ALTMODES], so values 30-254 read a kernel pointer from up to about 2KB past the array into adjacent connector/heap memory; that unbounded OOB read scores Confidentiality High.\nI:N - The OOB pointer is only compared to alt to choose 0 versus -EBUSY; it is never written, stored, or used as a write address, so there is no OOB write, use-after-free, or control-flow hijack primitive.\nA:H - An out-of-range CAM can load from unmapped heap, trip KASAN/UBSAN array-index-out-of-bounds, or oops as the fix describes, producing a kernel panic that the PPM can retrigger on each enter."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:40.331Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8fde7e4a366184e9a6aa95541e52933a73c00a74"
},
{
"url": "https://git.kernel.org/stable/c/83f1abd62cc134700ba92e1e2dc650a49a185497"
},
{
"url": "https://git.kernel.org/stable/c/1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456"
},
{
"url": "https://git.kernel.org/stable/c/58e0ee293ec5e06cacbe3953ad44042f1473dae9"
},
{
"url": "https://git.kernel.org/stable/c/ac9f878c468052af6571e8639ab1c3ae040b908f"
},
{
"url": "https://git.kernel.org/stable/c/33a81acd2d1d0667d4eff93cb90339fa53e617e8"
},
{
"url": "https://git.kernel.org/stable/c/bdaaf3074aedce8f1b173cc363d61cff5f6a585f"
},
{
"url": "https://git.kernel.org/stable/c/04cec690b1fd9d1c4c314b91a10d8c68a3acfe18"
}
],
"title": "usb: typec: ucsi: displayport: Fix OOB altmode array index",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90025",
"datePublished": "2026-09-16T10:33:28.313Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T14:41:40.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90024 (GCVE-0-2026-90024)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting
to clean up an endpoint that was never initialized.
When configuring the MIDI 2.0 gadget via configfs and setting the block
direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out
endpoint is explicitly skipped during the gadget bind phase
(f_midi2_bind()). As a result, the usb_ep->card field remains NULL.
Later, when the host sets the alternate setting, f_midi2_set_alt()
unconditionally stops both the IN and OUT endpoints by calling
f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both
endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized
midi1_ep_out, it attempts to dereference usb_ep->card to determine the
number of requests to free, leading to a crash.
Fix this by using usb_ep->num_reqs instead of usb_ep->card->info.num_reqs
in f_midi2_free_ep_reqs(). usb_ep->num_reqs is correctly set during
f_midi2_init_ep() and remains 0 if the endpoint was never initialized,
safely avoiding the loop. For consistency, apply the same change to
f_midi2_alloc_ep_reqs().
Oops: general protection fault, probably for non-canonical address
0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]
...
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166
[inline]
RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
drivers/usb/gadget/function/f_midi2.c:1246
...
Call Trace:
<TASK>
f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 51ddc55c75087ac25342f6d73d3aeaf14f59bd76
(git)
Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 5b92f6a0c7c01efbb335d837ecdf34d38d98720f (git) Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a (git) Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 4079f19a0e1ce76f1e21a398f02aca150ceaaf61 (git) Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < f0efaf1872949e96d213c8e910fd9517f7d7c406 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51ddc55c75087ac25342f6d73d3aeaf14f59bd76",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "5b92f6a0c7c01efbb335d837ecdf34d38d98720f",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "4079f19a0e1ce76f1e21a398f02aca150ceaaf61",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "f0efaf1872949e96d213c8e910fd9517f7d7c406",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs\n\nA null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting\nto clean up an endpoint that was never initialized.\n\nWhen configuring the MIDI 2.0 gadget via configfs and setting the block\ndirection to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out\nendpoint is explicitly skipped during the gadget bind phase\n(f_midi2_bind()). As a result, the usb_ep-\u003ecard field remains NULL.\n\nLater, when the host sets the alternate setting, f_midi2_set_alt()\nunconditionally stops both the IN and OUT endpoints by calling\nf_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both\nendpoints. When f_midi2_free_ep_reqs() is called for the uninitialized\nmidi1_ep_out, it attempts to dereference usb_ep-\u003ecard to determine the\nnumber of requests to free, leading to a crash.\n\nFix this by using usb_ep-\u003enum_reqs instead of usb_ep-\u003ecard-\u003einfo.num_reqs\nin f_midi2_free_ep_reqs(). usb_ep-\u003enum_reqs is correctly set during\nf_midi2_init_ep() and remains 0 if the endpoint was never initialized,\nsafely avoiding the loop. For consistency, apply the same change to\nf_midi2_alloc_ep_reqs().\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]\n...\nRIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166\n[inline]\nRIP: 0010:f_midi2_stop_eps+0x28e/0x4d0\ndrivers/usb/gadget/function/f_midi2.c:1246\n...\nCall Trace:\n \u003cTASK\u003e\n f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296\n composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933\n configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:27.624Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51ddc55c75087ac25342f6d73d3aeaf14f59bd76"
},
{
"url": "https://git.kernel.org/stable/c/5b92f6a0c7c01efbb335d837ecdf34d38d98720f"
},
{
"url": "https://git.kernel.org/stable/c/9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a"
},
{
"url": "https://git.kernel.org/stable/c/4079f19a0e1ce76f1e21a398f02aca150ceaaf61"
},
{
"url": "https://git.kernel.org/stable/c/f0efaf1872949e96d213c8e910fd9517f7d7c406"
}
],
"title": "usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90024",
"datePublished": "2026-09-16T10:33:27.624Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:27.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90023 (GCVE-0-2026-90023)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
Previously fsg_num_buffers_validate() was removed as it was not
necessary due to Kconfig setting the limits for n from 2 to 256 with
default as 2. However, setting the page content in such a way that
kstrtou8() reflects n value as either 0 or 1 bypasses these
restrictions leading to a null pointer dereference if n is 0. Fix
this by adding a check for n < 2 and returning -EINVAL if n is
either 0 or 1 consistent with Kconfig logic.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fe5a6c48fd954489f51aab151d5dad9254c76419 , < 9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957
(git)
Affected: fe5a6c48fd954489f51aab151d5dad9254c76419 , < b9b5b5df5b8dd3c1572ed267200276a44cc67d8e (git) Affected: fe5a6c48fd954489f51aab151d5dad9254c76419 , < 2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc (git) |
|
| Linux | Linux |
Affected:
4.8
Unaffected: 0 , < 4.8 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_mass_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
},
{
"lessThan": "b9b5b5df5b8dd3c1572ed267200276a44cc67d8e",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
},
{
"lessThan": "2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_mass_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()\n\nPreviously fsg_num_buffers_validate() was removed as it was not\nnecessary due to Kconfig setting the limits for n from 2 to 256 with\ndefault as 2. However, setting the page content in such a way that\nkstrtou8() reflects n value as either 0 or 1 bypasses these\nrestrictions leading to a null pointer dereference if n is 0. Fix\nthis by adding a check for n \u003c 2 and returning -EINVAL if n is\neither 0 or 1 consistent with Kconfig logic."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:26.905Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957"
},
{
"url": "https://git.kernel.org/stable/c/b9b5b5df5b8dd3c1572ed267200276a44cc67d8e"
},
{
"url": "https://git.kernel.org/stable/c/2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc"
}
],
"title": "usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90023",
"datePublished": "2026-09-16T10:33:26.905Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-09-16T10:33:26.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90022 (GCVE-0-2026-90022)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
usb: gadget: f_midi2: fix use-after-free in string attribute show path
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_midi2: fix use-after-free in string attribute show path
f_midi2_opts_str_show() takes the string lock internally, but its
callers dereference the opts->info.<field> pointer before calling it,
outside the lock. This races with f_midi2_opts_str_store(), which
frees the old string under opts->lock when the attribute is written
concurrently, the show path can read a pointer that gets freed
before the lock inside str_show() is even taken.
Change f_midi2_opts_str_show() to take a pointer to the string field,
matching the existing pattern in f_midi2_opts_str_store(), and
dereference it only after the lock is held. Update all three callers
(iface_name, block name, and the EP string option macro) accordingly.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f9bdf4c4f6410a1dfafafa383a0e21069372657f
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d11f3300b39e2daad2f0d9d66ddcc39a156cb594 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e89e30f0b5d3004fe5955250bd8b04f3733e32ce (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 49fab5e1bdb205c36c965d0e9677bc40d282d3a2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b (git) Affected: 0 , < 6.6.157 (semver) Affected: 0 , < 6.12.110 (semver) Affected: 0 , < 6.18.51 (semver) Affected: 0 , < 7.2.5 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.157 , ≤ 6.6.*
(semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9bdf4c4f6410a1dfafafa383a0e21069372657f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d11f3300b39e2daad2f0d9d66ddcc39a156cb594",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e89e30f0b5d3004fe5955250bd8b04f3733e32ce",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "49fab5e1bdb205c36c965d0e9677bc40d282d3a2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.157",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.110",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.51",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi2: fix use-after-free in string attribute show path\n\nf_midi2_opts_str_show() takes the string lock internally, but its\ncallers dereference the opts-\u003einfo.\u003cfield\u003e pointer before calling it,\noutside the lock. This races with f_midi2_opts_str_store(), which\nfrees the old string under opts-\u003elock when the attribute is written\nconcurrently, the show path can read a pointer that gets freed\nbefore the lock inside str_show() is even taken.\n\nChange f_midi2_opts_str_show() to take a pointer to the string field,\nmatching the existing pattern in f_midi2_opts_str_store(), and\ndereference it only after the lock is held. Update all three callers\n(iface_name, block name, and the EP string option macro) accordingly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached by concurrent local read/write of midi2 configfs string attributes (iface_name, ep_name, product_id, block name) under /sys/kernel/config/usb_gadget/\u003cg\u003e/functions/midi2.*; no USB host packets, cable, or UDC bind are required, matching other gadget configfs bugs scored Local rather than Physical.\nAC:L - The attacker controls both sides by opening the same attribute on two fds (configfs serializes only per-fd) and racing show against store; store kfree()s the prior kstrndup string under opts-\u003elock while show already holds the stale pointer, and the function need not be bound (store fails only if refcnt != 0).\nPR:L - gadgets_make(), function_make(), and the midi2 show/store handlers perform no capable() check; access is gated only by configfs DAC, and Android/embedded USB gadget HALs routinely chown /sys/kernel/config/usb_gadget to non-root system or daemon accounts.\nUI:N - The attacker creates the midi2 function instance and performs the concurrent attribute read/write themselves; configfs is typically already mounted at /sys/kernel/config, and no victim mount, cable plug, or other-user action is required.\nS:U - The use-after-free of the configfs kstrndup string corrupts kernel heap within the same host kernel security authority; this is not a VM escape, sandbox breakout, or IOMMU/DMA boundary bypass.\nC:H - Callers load opts-\u003einfo.\u003cfield\u003e outside the lock, then f_midi2_opts_str_show() scnprintfs that pointer after a concurrent store kfree()d it; reclaiming the kmalloc object lets the attacker control the bytes copied to userspace, a UAF disclosure primitive.\nI:H - The same UAF of the kstrndup string, with store spraying attacker-chosen size and content into the same slab, is a classic heap use-after-free that can be converted into overlapping objects, arbitrary write, and control-flow hijack.\nA:H - scnprintf() of the freed string after kfree() reliably produces a KASAN slab-use-after-free oops or kernel panic, which the attacker can retrigger with further concurrent show/store loops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:38.817Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9bdf4c4f6410a1dfafafa383a0e21069372657f"
},
{
"url": "https://git.kernel.org/stable/c/d11f3300b39e2daad2f0d9d66ddcc39a156cb594"
},
{
"url": "https://git.kernel.org/stable/c/e89e30f0b5d3004fe5955250bd8b04f3733e32ce"
},
{
"url": "https://git.kernel.org/stable/c/49fab5e1bdb205c36c965d0e9677bc40d282d3a2"
},
{
"url": "https://git.kernel.org/stable/c/fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b"
}
],
"title": "usb: gadget: f_midi2: fix use-after-free in string attribute show path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90022",
"datePublished": "2026-09-16T10:33:26.238Z",
"dateReserved": "2026-09-11T19:38:34.781Z",
"dateUpdated": "2026-09-16T14:41:38.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90021 (GCVE-0-2026-90021)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
usb: gadget: f_midi: initialize work in f_midi_alloc()
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_midi: initialize work in f_midi_alloc()
f_midi_alloc initializes free_ref to 1 and it can only be incremented
when a sound card is registered via f_midi_register_card().
f_midi_register_card() is only called in f_midi_bind() which actually
performs INIT_WORK. If f_midi_bind() is never run, work is not
initialized and the if condition in f_midi_free becomes true,
this results in a warning later in __flush_work as work->func = 0.
Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 3d8b11255e632170f32f1925bfcaf96331f36317
(git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 02ac76f27db23ef652358458c272d9d2d6f51167 (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 858576de6b2f5166b08dae803f0fd0766dcb3002 (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea (git) Affected: 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d (git) Affected: 3635523e9b96213969693c320302d536774d8e9b (git) Affected: 5.4.291 , < 5.5 (semver) Affected: 5.10.235 , < 5.11 (semver) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d8b11255e632170f32f1925bfcaf96331f36317",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "02ac76f27db23ef652358458c272d9d2d6f51167",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "858576de6b2f5166b08dae803f0fd0766dcb3002",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "7e07d3e4c389217d7d7171d80edf2e23ac70f1ea",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"status": "affected",
"version": "89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d",
"versionType": "git"
},
{
"status": "affected",
"version": "3635523e9b96213969693c320302d536774d8e9b",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.291",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.235",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.291",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.235",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: initialize work in f_midi_alloc()\n\nf_midi_alloc initializes free_ref to 1 and it can only be incremented\nwhen a sound card is registered via f_midi_register_card().\nf_midi_register_card() is only called in f_midi_bind() which actually\nperforms INIT_WORK. If f_midi_bind() is never run, work is not\ninitialized and the if condition in f_midi_free becomes true,\nthis results in a warning later in __flush_work as work-\u003efunc = 0.\nFix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:25.560Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d8b11255e632170f32f1925bfcaf96331f36317"
},
{
"url": "https://git.kernel.org/stable/c/02ac76f27db23ef652358458c272d9d2d6f51167"
},
{
"url": "https://git.kernel.org/stable/c/858576de6b2f5166b08dae803f0fd0766dcb3002"
},
{
"url": "https://git.kernel.org/stable/c/7e07d3e4c389217d7d7171d80edf2e23ac70f1ea"
}
],
"title": "usb: gadget: f_midi: initialize work in f_midi_alloc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90021",
"datePublished": "2026-09-16T10:33:25.560Z",
"dateReserved": "2026-09-11T19:38:34.781Z",
"dateUpdated": "2026-09-16T10:33:25.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90020 (GCVE-0-2026-90020)
Vulnerability from nvd – Published: 2026-09-16 10:33 – Updated: 2026-09-16 10:33
VLAI
EPSS
VEX
Title
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but
dev->state is checked after acquiring the lock. Therefore a concurrent
bind can change the device state between these operations, which can
leave ioctl with a stale NULL gadget pointer and causing a NULL pointer
dereference at gadget->ops->ioctl.
Read dev->gadget while holding dev->lock so that the gadget pointer
and device state are sampled consistently.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e8219accce2f6d3502ed71f5b5e854ecf27249a6 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 162178ca83c3de986900385a0477eb539f8e1a7e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ebd916fdfefaacbc0e577f7037ec96b31a105e5f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 64ec019bf9a8b12f53b9f2777d65aadb730b5a84 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dd0eed9e165b1a6292f49e622e3dd0b7d99b106d (git) Affected: 0 , < 5.10.270 (semver) Affected: 0 , < 5.15.221 (semver) Affected: 0 , < 6.1.188 (semver) Affected: 0 , < 6.6.157 (semver) Affected: 0 , < 6.12.110 (semver) Affected: 0 , < 6.18.51 (semver) Affected: 0 , < 7.2.5 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.270 , ≤ 5.10.*
(semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/legacy/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e8219accce2f6d3502ed71f5b5e854ecf27249a6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "162178ca83c3de986900385a0477eb539f8e1a7e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ebd916fdfefaacbc0e577f7037ec96b31a105e5f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "64ec019bf9a8b12f53b9f2777d65aadb730b5a84",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dd0eed9e165b1a6292f49e622e3dd0b7d99b106d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.270",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.221",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.188",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.157",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.110",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.51",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/legacy/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()\n\ngadget_dev_ioctl() reads dev-\u003egadget before acquiring dev-\u003elock, but\ndev-\u003estate is checked after acquiring the lock. Therefore a concurrent\nbind can change the device state between these operations, which can\nleave ioctl with a stale NULL gadget pointer and causing a NULL pointer\ndereference at gadget-\u003eops-\u003eioctl.\n\nRead dev-\u003egadget while holding dev-\u003elock so that the gadget pointer\nand device state are sampled consistently."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:33:24.866Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1"
},
{
"url": "https://git.kernel.org/stable/c/e8219accce2f6d3502ed71f5b5e854ecf27249a6"
},
{
"url": "https://git.kernel.org/stable/c/87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c"
},
{
"url": "https://git.kernel.org/stable/c/162178ca83c3de986900385a0477eb539f8e1a7e"
},
{
"url": "https://git.kernel.org/stable/c/ebd916fdfefaacbc0e577f7037ec96b31a105e5f"
},
{
"url": "https://git.kernel.org/stable/c/c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb"
},
{
"url": "https://git.kernel.org/stable/c/64ec019bf9a8b12f53b9f2777d65aadb730b5a84"
},
{
"url": "https://git.kernel.org/stable/c/dd0eed9e165b1a6292f49e622e3dd0b7d99b106d"
}
],
"title": "USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90020",
"datePublished": "2026-09-16T10:33:24.866Z",
"dateReserved": "2026-09-11T19:38:34.781Z",
"dateUpdated": "2026-09-16T10:33:24.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}