Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
34582 vulnerabilities by linux
CVE-2026-68082 (GCVE-0-2026-68082)
Vulnerability from nvd – Published: 2026-08-08 09:17 – Updated: 2026-08-08 09:17
VLAI
EPSS
VEX
Title
libceph: fix two unsafe bare decodes in decode_lockers()
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix two unsafe bare decodes in decode_lockers()
decode_lockers() in cls_lock_client.c contains two bare decode operations
that allow a malicious or compromised OSD to trigger slab-out-of-bounds
reads:
1. ceph_decode_32(p) at the num_lockers field has no preceding bounds
check. ceph_start_decoding() accepts struct_len=0 as valid -- the
internal ceph_decode_need(p, end, 0, bad) always passes -- so when an
OSD sends struct_len=0, ceph_start_decoding() returns success with
p == end. The immediately following bare ceph_decode_32(p) then reads
4 bytes past the validated buffer boundary. The garbage value is
passed directly to kzalloc_objs() as the locker count.
The sibling function decode_watchers() in osd_client.c already uses
ceph_decode_32_safe() after its own ceph_start_decoding() call.
decode_lockers() was the only site using the bare variant.
2. ceph_decode_8(p) after the decode_locker() loop has no preceding
bounds check. If an OSD crafts num_lockers such that the loop
advances p exactly to end, the subsequent bare ceph_decode_8(p) reads
one byte past the validated buffer boundary. The result is passed
directly into *type, which is used as a lock type discriminator by
callers, giving an OSD-controlled one-byte OOB read with direct
influence over the lock type field.
Fix both by replacing bare operations with their safe variants:
ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers,
err_inval)
ceph_decode_8(p) -> ceph_decode_8_safe(p, end, *type,
err_free_lockers)
The goto targets differ intentionally:
err_inval: is a new label returning -EINVAL directly. It is used for
the pre-allocation failure path where *lockers is not yet allocated
and must not be passed to ceph_free_lockers().
err_free_lockers: is the existing label. It is used for the
post-allocation failure path where *lockers is allocated and must
be freed.
ret is set to -EINVAL before ceph_decode_8_safe() so that
err_free_lockers returns the correct error code on bounds violation.
Without this, err_free_lockers would return a stale ret value (0 from
the successful decode_locker() loop), silently swallowing the error.
-EINVAL is correct for both failure paths. The data received from the
OSD is structurally malformed. -ENOMEM would misrepresent the failure
class to callers and to stable@ backporters triaging error paths.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
deployment can trigger this against any kernel client that issues the
lock.get_info class method (e.g. during RBD exclusive lock acquisition).
[ idryomov: trim changelog, formatting ]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d4ed4a530562881cc5225050e42d96034f405aae , < a54be593d0b749161b08a1e56189b2cb9114267a
(git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < a109a556115271ca7896dcda7b4b7e45e156c227 (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a54be593d0b749161b08a1e56189b2cb9114267a",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "a109a556115271ca7896dcda7b4b7e45e156c227",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix two unsafe bare decodes in decode_lockers()\n\ndecode_lockers() in cls_lock_client.c contains two bare decode operations\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds\nreads:\n\n1. ceph_decode_32(p) at the num_lockers field has no preceding bounds\n check. ceph_start_decoding() accepts struct_len=0 as valid -- the\n internal ceph_decode_need(p, end, 0, bad) always passes -- so when an\n OSD sends struct_len=0, ceph_start_decoding() returns success with\n p == end. The immediately following bare ceph_decode_32(p) then reads\n 4 bytes past the validated buffer boundary. The garbage value is\n passed directly to kzalloc_objs() as the locker count.\n\n The sibling function decode_watchers() in osd_client.c already uses\n ceph_decode_32_safe() after its own ceph_start_decoding() call.\n decode_lockers() was the only site using the bare variant.\n\n2. ceph_decode_8(p) after the decode_locker() loop has no preceding\n bounds check. If an OSD crafts num_lockers such that the loop\n advances p exactly to end, the subsequent bare ceph_decode_8(p) reads\n one byte past the validated buffer boundary. The result is passed\n directly into *type, which is used as a lock type discriminator by\n callers, giving an OSD-controlled one-byte OOB read with direct\n influence over the lock type field.\n\nFix both by replacing bare operations with their safe variants:\n ceph_decode_32(p) -\u003e ceph_decode_32_safe(p, end, *num_lockers,\n err_inval)\n ceph_decode_8(p) -\u003e ceph_decode_8_safe(p, end, *type,\n err_free_lockers)\n\nThe goto targets differ intentionally:\n err_inval: is a new label returning -EINVAL directly. It is used for\n the pre-allocation failure path where *lockers is not yet allocated\n and must not be passed to ceph_free_lockers().\n\n err_free_lockers: is the existing label. It is used for the\n post-allocation failure path where *lockers is allocated and must\n be freed.\n\nret is set to -EINVAL before ceph_decode_8_safe() so that\nerr_free_lockers returns the correct error code on bounds violation.\nWithout this, err_free_lockers would return a stale ret value (0 from\nthe successful decode_locker() loop), silently swallowing the error.\n\n-EINVAL is correct for both failure paths. The data received from the\nOSD is structurally malformed. -ENOMEM would misrepresent the failure\nclass to callers and to stable@ backporters triaging error paths.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).\n\n[ idryomov: trim changelog, formatting ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T09:17:45.394Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a54be593d0b749161b08a1e56189b2cb9114267a"
},
{
"url": "https://git.kernel.org/stable/c/a109a556115271ca7896dcda7b4b7e45e156c227"
}
],
"title": "libceph: fix two unsafe bare decodes in decode_lockers()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68082",
"datePublished": "2026-08-08T09:17:45.394Z",
"dateReserved": "2026-07-30T09:28:09.367Z",
"dateUpdated": "2026-08-08T09:17:45.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68081 (GCVE-0-2026-68081)
Vulnerability from nvd – Published: 2026-08-08 09:17 – Updated: 2026-08-08 09:17
VLAI
EPSS
VEX
Title
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid
guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path
doesn't use nested_vmx_vmexit() as that API is intended to be used if and
only if L2 is active, and the open coded equivalent neglects to put the
vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages
(and/or mappings) if L1 retries VMLAUNCH/VMRESUME.
Note, the !from_vmenter scenario doesn't suffer the same problem, as
vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is
active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry
getting vmcs12 pages.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
96c66e87deeeb3cc78a3b82a1de8e365eec206c1 , < 7996013b85687034d2e820cef94d6404192e3a3d
(git)
Affected: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 , < 2c87a087c20632d68920272173b5d7c47f9bcf70 (git) Affected: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 , < 2f2312c422fd2695da772cecb30c69994b795964 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7996013b85687034d2e820cef94d6404192e3a3d",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "2c87a087c20632d68920272173b5d7c47f9bcf70",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "2f2312c422fd2695da772cecb30c69994b795964",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state\n\nPut all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid\nguest while emulating VMLAUNCH or VMRESUME. The invalid guest state path\ndoesn\u0027t use nested_vmx_vmexit() as that API is intended to be used if and\nonly if L2 is active, and the open coded equivalent neglects to put the\nvmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages\n(and/or mappings) if L1 retries VMLAUNCH/VMRESUME.\n\nNote, the !from_vmenter scenario doesn\u0027t suffer the same problem, as\nvmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is\nactive, i.e. if a \"full\" VM-Exit is guaranteed before KVM will retry\ngetting vmcs12 pages."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T09:17:44.795Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7996013b85687034d2e820cef94d6404192e3a3d"
},
{
"url": "https://git.kernel.org/stable/c/2c87a087c20632d68920272173b5d7c47f9bcf70"
},
{
"url": "https://git.kernel.org/stable/c/2f2312c422fd2695da772cecb30c69994b795964"
}
],
"title": "KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68081",
"datePublished": "2026-08-08T09:17:44.795Z",
"dateReserved": "2026-07-30T09:28:09.367Z",
"dateUpdated": "2026-08-08T09:17:44.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68480 (GCVE-0-2026-68480)
Vulnerability from nvd – Published: 2026-08-06 17:36 – Updated: 2026-08-09 03:38
VLAI
EPSS
VEX
Title
x86/bugs: Make Safe-RET robust against interrupt injection
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Make Safe-RET robust against interrupt injection
An attacker injecting interrupts while the Safe-RET mitigation executes
on machines affected by SRSO can neutralize the safe return sequence,
potentially leading to data leakage through speculative execution.
Fixup register state as if the Safe-RET sequence executed successfully
by "emulating" it, in a manner of speaking, and avoid executing a RET
instruction after returning from the interrupt.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dfefa3c51370f84acb643cddf98bb42c885d0483
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 52db77a13be224e09eb4ba6b4252ae8ab9085c2c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d0208e08d64d99383e09852a76cc3038c5a4c3ab (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e262f28a69ae9e0791248f93b0173c1d1f3e1d5d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bfe7f9993467ba431b2731437949ac1e2634e771 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 61649a2d61cb0dbc673f0f232f0f0c298bf50442 (git) Affected: 0 , < 5.10.264 (semver) Affected: 0 , < 5.15.215 (semver) Affected: 0 , < 6.1.182 (semver) Affected: 0 , < 6.6.150 (semver) Affected: 0 , < 6.12.102 (semver) Affected: 0 , < 6.18.43 (semver) Affected: 0 , < 7.1.7 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.264 , ≤ 5.10.*
(semver)
Unaffected: 5.15.215 , ≤ 5.15.* (semver) Unaffected: 6.1.182 , ≤ 6.1.* (semver) Unaffected: 6.6.150 , ≤ 6.6.* (semver) Unaffected: 6.12.102 , ≤ 6.12.* (semver) Unaffected: 6.18.43 , ≤ 6.18.* (semver) Unaffected: 7.1.7 , ≤ 7.1.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_64.S",
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c",
"arch/x86/lib/retpoline.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dfefa3c51370f84acb643cddf98bb42c885d0483",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "52db77a13be224e09eb4ba6b4252ae8ab9085c2c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d0208e08d64d99383e09852a76cc3038c5a4c3ab",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e262f28a69ae9e0791248f93b0173c1d1f3e1d5d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bfe7f9993467ba431b2731437949ac1e2634e771",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "61649a2d61cb0dbc673f0f232f0f0c298bf50442",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.264",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.215",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.182",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.150",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.102",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.43",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_64.S",
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c",
"arch/x86/lib/retpoline.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.264",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.182",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.102",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.43",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.264",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.215",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.182",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.150",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.102",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Make Safe-RET robust against interrupt injection\n\nAn attacker injecting interrupts while the Safe-RET mitigation executes\non machines affected by SRSO can neutralize the safe return sequence,\npotentially leading to data leakage through speculative execution.\n\nFixup register state as if the Safe-RET sequence executed successfully\nby \"emulating\" it, in a manner of speaking, and avoid executing a RET\ninstruction after returning from the interrupt."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T03:38:14.420Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"
},
{
"url": "https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"
},
{
"url": "https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab"
},
{
"url": "https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096"
},
{
"url": "https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d"
},
{
"url": "https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771"
},
{
"url": "https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442"
},
{
"url": "https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf"
}
],
"title": "x86/bugs: Make Safe-RET robust against interrupt injection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68480",
"datePublished": "2026-08-06T17:36:43.654Z",
"dateReserved": "2026-07-30T09:28:09.397Z",
"dateUpdated": "2026-08-09T03:38:14.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64604 (GCVE-0-2026-64604)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 17:37
VLAI
EPSS
VEX
Title
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.
------------[ cut here ]------------
debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
Modules linked in:
CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
Call Trace:
<TASK>
apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
No functional change intended.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a7c0b07d570848e50fce4d31ac01313484d6b844 , < c7cd3605244c924249dea32632e1bc3e89bda543
(git)
Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 9a21f1defd96c6301c5fb462a78eb51b191bd2dd (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 570af5db081b87374594a00711ac5760d2ea6844 (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4 (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 3dcfb04dd43b16fa1240fc6487fff578ad57264c (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < db8407b9fd06d857a4a5e8bcff1d086d13007711 (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 7ef78d71ca713d8c00f7c34ddcf276c808143f77 (git) |
|
| Linux | Linux |
Affected:
3.18
Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/vmx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7cd3605244c924249dea32632e1bc3e89bda543",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "9a21f1defd96c6301c5fb462a78eb51b191bd2dd",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "570af5db081b87374594a00711ac5760d2ea6844",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "3dcfb04dd43b16fa1240fc6487fff578ad57264c",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "db8407b9fd06d857a4a5e8bcff1d086d13007711",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "7ef78d71ca713d8c00f7c34ddcf276c808143f77",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/vmx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode\n\nWhen updating CR8 intercepts, get vmcs12 if and only if the vCPU is in\nguest mode so that a future change can have update CR8 intercepts during\nvCPU creation, without running afoul of get_vmcs12()\u0027s lockdep assertion.\n\n ------------[ cut here ]------------\n debug_locks \u0026\u0026 !(lock_is_held(\u0026(\u0026vcpu-\u003emutex)-\u003edep_map) || !refcount_read(\u0026vcpu-\u003ekvm-\u003eusers_count))\n WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879\n WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879\n Modules linked in:\n CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]\n RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879\n Call Trace:\n \u003cTASK\u003e\n apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]\n kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023\n kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986\n kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847\n kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201\n kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nNo functional change intended."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:37:50.817Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543"
},
{
"url": "https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd"
},
{
"url": "https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844"
},
{
"url": "https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a"
},
{
"url": "https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4"
},
{
"url": "https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c"
},
{
"url": "https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711"
},
{
"url": "https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77"
}
],
"title": "KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64604",
"datePublished": "2026-08-06T07:13:55.718Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T17:37:50.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64603 (GCVE-0-2026-64603)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
platform/x86: intel-hid: Protect ACPI notify handler against recursion
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: intel-hid: Protect ACPI notify handler against recursion
Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on
all CPUs") ACPI notify handlers like the intel-hid notify_handler() may
run on multiple CPU cores racing with themselves.
On convertibles and detachables (matched by DMI chassis-type 31 and 32 in
dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered
lazily from notify_handler() on the first tablet-mode event, via
intel_hid_switches_setup(). When two such events race on different CPUs
both can pass the !priv->switches check and register the priv->switches
input device twice, resulting in a duplicate sysfs entry and a subsequent
NULL pointer dereference.
This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86:
intel-vbtn: Protect ACPI notify handler against recursion") for the
sibling intel-vbtn driver.
Protect intel-hid notify_handler() from racing with itself with a mutex
to fix this.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2ffcda1629012a2c1a3706432bc45fdc899a584 , < a6402808e552e44e9c26a9fe8395ac11703d5800
(git)
Affected: e2ffcda1629012a2c1a3706432bc45fdc899a584 , < 86df6499dfd232fbc1c82c0d6eb9322ca67b8cd0 (git) Affected: e2ffcda1629012a2c1a3706432bc45fdc899a584 , < eace3b3e729d5ba11794d69acfafb58a7950217c (git) Affected: e2ffcda1629012a2c1a3706432bc45fdc899a584 , < c085d82613d5618814b84406c8b2d64f1bc305e7 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/intel/hid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6402808e552e44e9c26a9fe8395ac11703d5800",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
},
{
"lessThan": "86df6499dfd232fbc1c82c0d6eb9322ca67b8cd0",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
},
{
"lessThan": "eace3b3e729d5ba11794d69acfafb58a7950217c",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
},
{
"lessThan": "c085d82613d5618814b84406c8b2d64f1bc305e7",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/intel/hid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: intel-hid: Protect ACPI notify handler against recursion\n\nSince commit e2ffcda16290 (\"ACPI: OSL: Allow Notify () handlers to run on\nall CPUs\") ACPI notify handlers like the intel-hid notify_handler() may\nrun on multiple CPU cores racing with themselves.\n\nOn convertibles and detachables (matched by DMI chassis-type 31 and 32 in\ndmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered\nlazily from notify_handler() on the first tablet-mode event, via\nintel_hid_switches_setup(). When two such events race on different CPUs\nboth can pass the !priv-\u003eswitches check and register the priv-\u003eswitches\ninput device twice, resulting in a duplicate sysfs entry and a subsequent\nNULL pointer dereference.\n\nThis is the same class of bug fixed by commit e075c3b13a0a (\"platform/x86:\nintel-vbtn: Protect ACPI notify handler against recursion\") for the\nsibling intel-vbtn driver.\n\nProtect intel-hid notify_handler() from racing with itself with a mutex\nto fix this."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:55.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6402808e552e44e9c26a9fe8395ac11703d5800"
},
{
"url": "https://git.kernel.org/stable/c/86df6499dfd232fbc1c82c0d6eb9322ca67b8cd0"
},
{
"url": "https://git.kernel.org/stable/c/eace3b3e729d5ba11794d69acfafb58a7950217c"
},
{
"url": "https://git.kernel.org/stable/c/c085d82613d5618814b84406c8b2d64f1bc305e7"
}
],
"title": "platform/x86: intel-hid: Protect ACPI notify handler against recursion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64603",
"datePublished": "2026-08-06T07:13:55.114Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:55.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64602 (GCVE-0-2026-64602)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
iio: adc: spear: Initialize completion before requesting IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: spear: Initialize completion before requesting IRQ
In the report from Jaeyoung Chung:
"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in spear_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
spear_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < aea8ae6c4d3ed58d9223360f758df6bd8b90c608
(git)
Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < 67a49ab41320b3f721ce4be7447754ff040acbd5 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < a50757398794aaa25f908b96c6733e045466cba4 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < f3f90bc7b38ba3ff14f131cea0f8eb77624787a8 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < 37077d8271b1f24894fbc21bca1c4cd337525d31 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < bbfebae473ac2c8a194523b29ccb9b45f02f134c (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < eb5b07c9d0ec1a9d4b6871b14793c19967d79dc4 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 (git) |
|
| Linux | Linux |
Affected:
3.16
Unaffected: 0 , < 3.16 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/spear_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aea8ae6c4d3ed58d9223360f758df6bd8b90c608",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "67a49ab41320b3f721ce4be7447754ff040acbd5",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "a50757398794aaa25f908b96c6733e045466cba4",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "f3f90bc7b38ba3ff14f131cea0f8eb77624787a8",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "37077d8271b1f24894fbc21bca1c4cd337525d31",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "bbfebae473ac2c8a194523b29ccb9b45f02f134c",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "eb5b07c9d0ec1a9d4b6871b14793c19967d79dc4",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/spear_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: spear: Initialize completion before requesting IRQ\n\nIn the report from Jaeyoung Chung:\n\n\"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its\ninterrupt handler with devm_request_irq() before it initializes\nst-\u003ecompletion with init_completion(). If an interrupt arrives after\ndevm_request_irq() and before init_completion(), the handler calls\ncomplete() on an uninitialized completion, causing a kernel panic.\n\nThe probe path, in spear_adc_probe():\n\n iodev = devm_iio_device_alloc(\u0026pdev-\u003edev, sizeof(*st)); /* st kzalloc-zeroed */\n ...\n retval = devm_request_irq(\u0026pdev-\u003edev, irq, spear_adc_isr, 0,\n LPC32XXAD_NAME, st); /* register handler */\n ...\n init_completion(\u0026st-\u003ecompletion); /* initialize completion */\n\nspear_adc_isr() calls complete():\n\n complete(\u0026st-\u003ecompletion);\n\nIf the device raises an interrupt before init_completion() runs,\ncomplete() acquires the uninitialized wait.lock and walks the zeroed\ntask_list in swake_up_locked(). The zeroed task_list makes list_empty()\nreturn false, so swake_up_locked() dereferences a NULL list entry,\ntriggering a KASAN wild-memory-access.\"\n\nFix the chance of a spurious IRQ causing an uninitialized pointer\ndereference by moving init_completion() above devm_request_irq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:54.519Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aea8ae6c4d3ed58d9223360f758df6bd8b90c608"
},
{
"url": "https://git.kernel.org/stable/c/67a49ab41320b3f721ce4be7447754ff040acbd5"
},
{
"url": "https://git.kernel.org/stable/c/a50757398794aaa25f908b96c6733e045466cba4"
},
{
"url": "https://git.kernel.org/stable/c/f3f90bc7b38ba3ff14f131cea0f8eb77624787a8"
},
{
"url": "https://git.kernel.org/stable/c/37077d8271b1f24894fbc21bca1c4cd337525d31"
},
{
"url": "https://git.kernel.org/stable/c/bbfebae473ac2c8a194523b29ccb9b45f02f134c"
},
{
"url": "https://git.kernel.org/stable/c/eb5b07c9d0ec1a9d4b6871b14793c19967d79dc4"
},
{
"url": "https://git.kernel.org/stable/c/3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0"
}
],
"title": "iio: adc: spear: Initialize completion before requesting IRQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64602",
"datePublished": "2026-08-06T07:13:54.519Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:54.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64601 (GCVE-0-2026-64601)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
In capture_urb_complete(), usb_anchor_urb() is called on every
completion callback, but the URB is already anchored from the
initial submission in tascam_trigger_start(). Each redundant call
corrupts the anchor's doubly-linked list and inflates the URB
refcount. When usb_kill_anchored_urbs() traverses the list during
stream stop / suspend / disconnect, the corrupted list leads to
use-after-free.
Remove the redundant usb_anchor_urb() from the resubmit path.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c1bb0c13e430623c26543baae5bb9ae21139db87 , < 16f14f55141d4c55c3f321f93c328fff7cd6860a
(git)
Affected: c1bb0c13e430623c26543baae5bb9ae21139db87 , < ab1db64912428cdf06a4f9542e16e0575e9ad59f (git) Affected: c1bb0c13e430623c26543baae5bb9ae21139db87 , < 5cff1529a2f9b3461a7f5a6e36a86682fc290534 (git) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/usx2y/us144mkii_capture.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "16f14f55141d4c55c3f321f93c328fff7cd6860a",
"status": "affected",
"version": "c1bb0c13e430623c26543baae5bb9ae21139db87",
"versionType": "git"
},
{
"lessThan": "ab1db64912428cdf06a4f9542e16e0575e9ad59f",
"status": "affected",
"version": "c1bb0c13e430623c26543baae5bb9ae21139db87",
"versionType": "git"
},
{
"lessThan": "5cff1529a2f9b3461a7f5a6e36a86682fc290534",
"status": "affected",
"version": "c1bb0c13e430623c26543baae5bb9ae21139db87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/usx2y/us144mkii_capture.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission\n\nIn capture_urb_complete(), usb_anchor_urb() is called on every\ncompletion callback, but the URB is already anchored from the\ninitial submission in tascam_trigger_start(). Each redundant call\ncorrupts the anchor\u0027s doubly-linked list and inflates the URB\nrefcount. When usb_kill_anchored_urbs() traverses the list during\nstream stop / suspend / disconnect, the corrupted list leads to\nuse-after-free.\n\nRemove the redundant usb_anchor_urb() from the resubmit path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through local ALSA PCM open/ioctl paths on /dev/snd/pcmC*D* (START/STOP via tascam_pcm_trigger), not via network protocols; a present TASCAM US-144/US-144MKII is a deployment prerequisite, and Local is chosen over Physical under the uncertainty rule.\nAC:L - An attacker who can open the PCM device can deterministically start capture (submitting URBs that complete and hit capture_urb_complete), then stop/suspend to invoke usb_kill_anchored_urbs on the corrupted anchor; no conditions outside attacker control are required.\nPR:L - The PCM path has no capability checks; ordinary local access to ALSA device nodes (audio group or seat/udev ACLs on studio/desktop systems with this interface) is sufficient, not init-namespace root.\nUI:N - The attacker alone opens the PCM device, starts and stops the stream, and thereby triggers URB resubmission corruption and the subsequent kill/UAF path without any separate victim action.\nS:U - The use-after-free corrupts kernel USB/ALSA state within the same host kernel security authority and does not cross a VM, IOMMU, or other separate boundary.\nC:H - Corrupted usb_anchor list traversal during usb_kill_anchored_urbs yields a kernel use-after-free; per guidance UAF enables reclaim of freed objects and arbitrary kernel information disclosure.\nI:H - The same UAF on URB/anchor-linked objects can be turned into heap reuse and control-flow hijacking primitives, so integrity impact is High rather than a mere crash.\nA:H - Traversing the corrupted anchor list or under-referenced URB state during stream stop, suspend, or disconnect can oops/panic the kernel, giving High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:30.429Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/16f14f55141d4c55c3f321f93c328fff7cd6860a"
},
{
"url": "https://git.kernel.org/stable/c/ab1db64912428cdf06a4f9542e16e0575e9ad59f"
},
{
"url": "https://git.kernel.org/stable/c/5cff1529a2f9b3461a7f5a6e36a86682fc290534"
}
],
"title": "ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64601",
"datePublished": "2026-08-06T07:13:53.926Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-08T15:13:30.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64599 (GCVE-0-2026-64599)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
When meson_allocate_chanlist() fails after a partial allocation, it already
unwinds the allocated chanlist state through its local error path.
meson_crypto_probe() then jump to error_flow and calls
meson_free_chanlist() again, causing the same per-flow resources to be torn
down twice. In the reproduced failure path, the second teardown
re-entered crypto_engine_exit() on an already destroyed worker and KASAN
reported a slab-use-after-free in kthread_destroy_worker().
Prevent double-free by handling partial allocation failures locally within
meson_allocate_chanlist() and skipping the outer cleanup path.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available.
The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1,
using the reproducer under tools/testing/meson_crypto_probe. The reproducer
forces the second dma_alloc_attrs() call in the gxl-crypto probe path to
return NULL, making meson_allocate_chanlist() fail after partial
initialization. On the unpatched kernel this reliably triggered a
slab-use-after-free. With this fix applied, the same reproducer no longer
emits any KASAN report and the probe fails cleanly with -ENOMEM.
==================================================================
BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0
Read of size 8 at addr ff1100010c057a68 by task insmod/265
CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy)
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x68/0xa0
print_report+0xcb/0x5e0
? __virt_addr_valid+0x21d/0x3f0
? kthread_destroy_worker+0xb2/0xd0
? kthread_destroy_worker+0xb2/0xd0
kasan_report+0xca/0x100
? kthread_destroy_worker+0xb2/0xd0
kthread_destroy_worker+0xb2/0xd0
meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto]
platform_probe+0x99/0x140
really_probe+0x1c6/0x6a0
? __pfx___device_attach_driver+0x10/0x10
__driver_probe_device+0x248/0x310
? acpi_driver_match_device+0xb0/0x100
driver_probe_device+0x48/0x210
? __pfx___device_attach_driver+0x10/0x10
__device_attach_driver+0x160/0x320
bus_for_each_drv+0x104/0x190
? __pfx_bus_for_each_drv+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
__device_attach+0x19d/0x3b0
? __pfx___device_attach+0x10/0x10
? do_raw_spin_unlock+0x53/0x220
device_initial_probe+0x78/0xa0
bus_probe_device+0x5b/0x130
device_add+0xcfd/0x1430
? __pfx_device_add+0x10/0x10
? insert_resource+0x34/0x50
? lock_release+0xc9/0x290
platform_device_add+0x24e/0x590
? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro]
meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro]
do_one_initcall+0xc0/0x450
? __pfx_do_one_initcall+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
? __create_object+0x59/0x80
? kasan_unpoison+0x27/0x60
do_init_module+0x27b/0x7d0
? __pfx_do_init_module+0x10/0x10
? kasan_quarantine_put+0x84/0x1d0
? kfree+0x32c/0x510
? load_module+0x561e/0x5ff0
load_module+0x54fe/0x5ff0
? __pfx_load_module+0x10/0x10
? security_file_permission+0x20/0x40
? kernel_read_file+0x23d/0x6e0
? mmap_region+0x235/0x4a0
? __pfx_kernel_read_file+0x10/0x10
? __file_has_perm+0x2c0/0x3e0
init_module_from_file+0x158/0x180
? __pfx_init_module_from_file+0x10/0x10
? __lock_acquire+0x45a/0x1ba0
? idempotent_init_module+0x315/0x610
? lock_release+0xc9/0x290
? lock
---truncated---
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
48fe583fe54177bfb80f348e2a5cc34c3f710095 , < c2c48aa7a6be36d4c93da75d14d4b4f2f4168c81
(git)
Affected: 48fe583fe54177bfb80f348e2a5cc34c3f710095 , < c80360b4e85099fc3835378a96a59c0a2480fb07 (git) Affected: 48fe583fe54177bfb80f348e2a5cc34c3f710095 , < 5b452019a4127f63c1f2147237fc287d1581f606 (git) Affected: 48fe583fe54177bfb80f348e2a5cc34c3f710095 , < f30e2b879bda14bc3e1524fba6f8ab9ec119da90 (git) Affected: 48fe583fe54177bfb80f348e2a5cc34c3f710095 , < 6effdbaca3cd8354540bdf42c7f5fb84412afeb7 (git) Affected: 48fe583fe54177bfb80f348e2a5cc34c3f710095 , < 84a00be9b736aa5dce902a290f62cbbbdcfab9ed (git) Affected: 48fe583fe54177bfb80f348e2a5cc34c3f710095 , < 6dda8406d8a3da2519c8b388d443d7357839cb63 (git) Affected: 48fe583fe54177bfb80f348e2a5cc34c3f710095 , < 6d827ade51a24e18d81afb9f32756d339520a14c (git) |
|
| Linux | Linux |
Affected:
5.5
Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/amlogic/amlogic-gxl-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2c48aa7a6be36d4c93da75d14d4b4f2f4168c81",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
},
{
"lessThan": "c80360b4e85099fc3835378a96a59c0a2480fb07",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
},
{
"lessThan": "5b452019a4127f63c1f2147237fc287d1581f606",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
},
{
"lessThan": "f30e2b879bda14bc3e1524fba6f8ab9ec119da90",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
},
{
"lessThan": "6effdbaca3cd8354540bdf42c7f5fb84412afeb7",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
},
{
"lessThan": "84a00be9b736aa5dce902a290f62cbbbdcfab9ed",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
},
{
"lessThan": "6dda8406d8a3da2519c8b388d443d7357839cb63",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
},
{
"lessThan": "6d827ade51a24e18d81afb9f32756d339520a14c",
"status": "affected",
"version": "48fe583fe54177bfb80f348e2a5cc34c3f710095",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/amlogic/amlogic-gxl-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: amlogic - avoid double cleanup in meson_crypto_probe()\n\nWhen meson_allocate_chanlist() fails after a partial allocation, it already\nunwinds the allocated chanlist state through its local error path.\nmeson_crypto_probe() then jump to error_flow and calls\nmeson_free_chanlist() again, causing the same per-flow resources to be torn\ndown twice. In the reproduced failure path, the second teardown\nre-entered crypto_engine_exit() on an already destroyed worker and KASAN\nreported a slab-use-after-free in kthread_destroy_worker().\n\nPrevent double-free by handling partial allocation failures locally within\nmeson_allocate_chanlist() and skipping the outer cleanup path.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable.\n\nThe bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1,\nusing the reproducer under tools/testing/meson_crypto_probe. The reproducer\nforces the second dma_alloc_attrs() call in the gxl-crypto probe path to\nreturn NULL, making meson_allocate_chanlist() fail after partial\ninitialization. On the unpatched kernel this reliably triggered a\nslab-use-after-free. With this fix applied, the same reproducer no longer\nemits any KASAN report and the probe fails cleanly with -ENOMEM.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0\n Read of size 8 at addr ff1100010c057a68 by task insmod/265\n\n CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy)\n Tainted: [O]=OOT_MODULE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x68/0xa0\n print_report+0xcb/0x5e0\n ? __virt_addr_valid+0x21d/0x3f0\n ? kthread_destroy_worker+0xb2/0xd0\n ? kthread_destroy_worker+0xb2/0xd0\n kasan_report+0xca/0x100\n ? kthread_destroy_worker+0xb2/0xd0\n kthread_destroy_worker+0xb2/0xd0\n meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto]\n platform_probe+0x99/0x140\n really_probe+0x1c6/0x6a0\n ? __pfx___device_attach_driver+0x10/0x10\n __driver_probe_device+0x248/0x310\n ? acpi_driver_match_device+0xb0/0x100\n driver_probe_device+0x48/0x210\n ? __pfx___device_attach_driver+0x10/0x10\n __device_attach_driver+0x160/0x320\n bus_for_each_drv+0x104/0x190\n ? __pfx_bus_for_each_drv+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x2c/0x50\n __device_attach+0x19d/0x3b0\n ? __pfx___device_attach+0x10/0x10\n ? do_raw_spin_unlock+0x53/0x220\n device_initial_probe+0x78/0xa0\n bus_probe_device+0x5b/0x130\n device_add+0xcfd/0x1430\n ? __pfx_device_add+0x10/0x10\n ? insert_resource+0x34/0x50\n ? lock_release+0xc9/0x290\n platform_device_add+0x24e/0x590\n ? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro]\n meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro]\n do_one_initcall+0xc0/0x450\n ? __pfx_do_one_initcall+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x2c/0x50\n ? __create_object+0x59/0x80\n ? kasan_unpoison+0x27/0x60\n do_init_module+0x27b/0x7d0\n ? __pfx_do_init_module+0x10/0x10\n ? kasan_quarantine_put+0x84/0x1d0\n ? kfree+0x32c/0x510\n ? load_module+0x561e/0x5ff0\n load_module+0x54fe/0x5ff0\n ? __pfx_load_module+0x10/0x10\n ? security_file_permission+0x20/0x40\n ? kernel_read_file+0x23d/0x6e0\n ? mmap_region+0x235/0x4a0\n ? __pfx_kernel_read_file+0x10/0x10\n ? __file_has_perm+0x2c0/0x3e0\n init_module_from_file+0x158/0x180\n ? __pfx_init_module_from_file+0x10/0x10\n ? __lock_acquire+0x45a/0x1ba0\n ? idempotent_init_module+0x315/0x610\n ? lock_release+0xc9/0x290\n ? lock\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only in the Amlogic GXL platform driver probe path (meson_crypto_probe \u2192 meson_allocate_chanlist error unwind), via boot/deferred probe, module bind, or local sysfs rebind\u2014not from network, adjacent, or physical I/O.\nAC:L - Once meson_allocate_chanlist() fails after partial engine/DMA setup, the outer error_flow double-calls meson_free_chanlist() deterministically; a local attacker can induce that ENOMEM with memory pressure or allocation failure, with no race beyond their control.\nPR:L - On Amlogic GXL devices the DT node is status=okay and probes automatically (including deferred retries when clocks/IRQs appear); an ordinary local user can apply memory pressure during that probe without CAP_SYS_MODULE or init-namespace root, matching the higher-severity choice over PR:H.\nUI:N - No victim action such as opening a file or mounting a filesystem is required; probe error unwinding runs entirely in kernel context once allocation failure is induced.\nS:U - The double-free/UAF corrupts host kernel heap and crypto-engine worker state within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary by itself.\nC:H - The second teardown re-enters crypto_engine_exit()/kthread_destroy_worker() and dma_free_coherent() on already freed objects (confirmed KASAN slab-UAF), which can expose arbitrary kernel memory via attacker-controlled reuse of the freed slabs.\nI:H - Double-free of kthread_worker and DMA descriptor buffers yields overlapping live objects and classic heap corruption primitives that can be leveraged for arbitrary kernel writes or control-flow hijacking, not merely a clean crash.\nA:H - The use-after-free and double-free paths reliably cause kernel oops/panic (KASAN reported slab-UAF in kthread_destroy_worker), and NULL engine pointers on early failure also crash via crypto_engine_exit(NULL)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:29.305Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2c48aa7a6be36d4c93da75d14d4b4f2f4168c81"
},
{
"url": "https://git.kernel.org/stable/c/c80360b4e85099fc3835378a96a59c0a2480fb07"
},
{
"url": "https://git.kernel.org/stable/c/5b452019a4127f63c1f2147237fc287d1581f606"
},
{
"url": "https://git.kernel.org/stable/c/f30e2b879bda14bc3e1524fba6f8ab9ec119da90"
},
{
"url": "https://git.kernel.org/stable/c/6effdbaca3cd8354540bdf42c7f5fb84412afeb7"
},
{
"url": "https://git.kernel.org/stable/c/84a00be9b736aa5dce902a290f62cbbbdcfab9ed"
},
{
"url": "https://git.kernel.org/stable/c/6dda8406d8a3da2519c8b388d443d7357839cb63"
},
{
"url": "https://git.kernel.org/stable/c/6d827ade51a24e18d81afb9f32756d339520a14c"
}
],
"title": "crypto: amlogic - avoid double cleanup in meson_crypto_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64599",
"datePublished": "2026-08-06T07:13:53.328Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-08T15:13:29.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64598 (GCVE-0-2026-64598)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
smb/client: Fix error code in smb2_aead_req_alloc()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/client: Fix error code in smb2_aead_req_alloc()
The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work.
We would have to do something similar to the previous line where it's
cast to int and then long. However, it's simpler to store the return in
an int ret variable.
This bug would eventually result in a crash when dereference the invalid
error pointer.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < aa37f5fef78dd11cbf983269da2031e12625c56d
(git)
Affected: d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < cad756733dc3985188983f3e2eb77e2927209099 (git) Affected: d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < a187883cc1dc784a4d32537f5d316f1b7b9ad76f (git) Affected: d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < a1cc432cb0b0a1f74f98a0db3b94ca880c7947ac (git) Affected: d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < 61f28012e5650c619223decdb7970e0d3162e949 (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aa37f5fef78dd11cbf983269da2031e12625c56d",
"status": "affected",
"version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
"versionType": "git"
},
{
"lessThan": "cad756733dc3985188983f3e2eb77e2927209099",
"status": "affected",
"version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
"versionType": "git"
},
{
"lessThan": "a187883cc1dc784a4d32537f5d316f1b7b9ad76f",
"status": "affected",
"version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
"versionType": "git"
},
{
"lessThan": "a1cc432cb0b0a1f74f98a0db3b94ca880c7947ac",
"status": "affected",
"version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
"versionType": "git"
},
{
"lessThan": "61f28012e5650c619223decdb7970e0d3162e949",
"status": "affected",
"version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: Fix error code in smb2_aead_req_alloc()\n\nThe \"*num_sgs\" variable is a u32 so \"ERR_PTR(*num_sgs)\" doesn\u0027t work.\nWe would have to do something similar to the previous line where it\u0027s\ncast to int and then long. However, it\u0027s simpler to store the return in\nan int ret variable.\n\nThis bug would eventually result in a crash when dereference the invalid\nerror pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The buggy smb2_aead_req_alloc()/crypt_message() path runs in the in-kernel SMB3 client during encrypted transform processing over an SMB network session; the highest-severity scenario is a client mounting and using an untrusted or malicious SMB3 encrypted share.\nAC:L - When cifs_get_num_sgs() returns a negative errno, the u32 truncation makes ERR_PTR() bypass IS_ERR() deterministically on 64-bit, and the subsequent sg_init_marker()/pointer use crashes without requiring an attacker-uncontrollable race or memory layout.\nPR:N - The attacking SMB endpoint or network adversary needs no privileges or account on the victim client; client-side credentials used to mount the share are a victim condition, not attacker privileges.\nUI:R - A victim must mount or otherwise use an SMB3 share with encryption so the client encrypt/decrypt AEAD allocation path runs; per CVSS guidance, mounting a filesystem is user interaction.\nS:U - The invalid error-pointer dereference and resulting kernel memory access remain within the client kernel\u0027s security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - IS_ERR() failure leads to wild pointer use (uninitialized AEAD/sg state and invalid creq), which under the required uncertainty rule is treated as a high-impact kernel memory disclosure primitive rather than a pure non-leaking crash.\nI:H - The same path performs a wild write via sg_mark_end() on a bogus scatterlist address and may later kfree_sensitive() an invalid pointer, yielding kernel memory corruption; under uncertainty this is scored as high integrity impact.\nA:H - The commit-documented result is a kernel crash from dereferencing the invalid error pointer; sg_init_marker() on a NULL sgl with a huge truncated nents count causes a reliable oops/panic DoS."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:28.185Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aa37f5fef78dd11cbf983269da2031e12625c56d"
},
{
"url": "https://git.kernel.org/stable/c/cad756733dc3985188983f3e2eb77e2927209099"
},
{
"url": "https://git.kernel.org/stable/c/a187883cc1dc784a4d32537f5d316f1b7b9ad76f"
},
{
"url": "https://git.kernel.org/stable/c/a1cc432cb0b0a1f74f98a0db3b94ca880c7947ac"
},
{
"url": "https://git.kernel.org/stable/c/61f28012e5650c619223decdb7970e0d3162e949"
}
],
"title": "smb/client: Fix error code in smb2_aead_req_alloc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64598",
"datePublished": "2026-08-06T07:13:52.716Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-08T15:13:28.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64597 (GCVE-0-2026-64597)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
smb: client: fix double-free in SMB2_close() replay
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_close() replay
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_close_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
433042a91f9373241307725b52de573933ffedbf , < 037511726228aaf165c7067ff2bfc88eaecdf1f3
(git)
Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < 0aa97edf7c347c0f54e7e60c4740574b8120c66a (git) Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < d15d83125007f673aec4323e1bbbaaffbe87ea13 (git) Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < b18ed621dbfceecea5539848cddcb9272c9a61e1 (git) Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < f96e1cdcb63ed3321142ff2fcdf784e32cda8fee (git) Affected: 6.6.32 , < 6.6.145 (semver) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "037511726228aaf165c7067ff2bfc88eaecdf1f3",
"status": "affected",
"version": "433042a91f9373241307725b52de573933ffedbf",
"versionType": "git"
},
{
"lessThan": "0aa97edf7c347c0f54e7e60c4740574b8120c66a",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "d15d83125007f673aec4323e1bbbaaffbe87ea13",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "b18ed621dbfceecea5539848cddcb9272c9a61e1",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "f96e1cdcb63ed3321142ff2fcdf784e32cda8fee",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_close() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_close_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised SMB server triggers the double-free via crafted SMB2 CLOSE responses over the network, returning replayable NTSTATUS values that map to -EAGAIN/-ECONNABORTED while leaving a response buffer for the client to free.\nAC:L - The attacking server controls both sides of the sequence by returning a replayable CLOSE status with a response buffer, then dropping or forcing reconnect so SMB2_close_init fails before the next send, and can repeat until the stale free occurs.\nPR:N - The attacking SMB endpoint needs no account or privileges on the victim client; once an SMB session and handle exist, the server alone drives the vulnerable CLOSE replay path.\nUI:N - On an already mounted or automounted share, background paths such as cached-directory close and cancelled-close work, as well as routine service file closes, can invoke SMB2_close without interactive user action at exploit time.\nS:U - The mempool double-free corrupts kernel memory within the same host kernel security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - Double-free of a CIFS small/large response buffer can create overlapping live allocations and use-after-free reads, enabling disclosure of arbitrary kernel memory.\nI:H - Reallocation of the freed mempool object with attacker-controlled network data can corrupt live kernel objects or allocator metadata, enabling arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can immediately trigger allocator BUG diagnostics, heap corruption, oops, or panic, and the server can retrigger the path repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:27.088Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3"
},
{
"url": "https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a"
},
{
"url": "https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13"
},
{
"url": "https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1"
},
{
"url": "https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee"
}
],
"title": "smb: client: fix double-free in SMB2_close() replay",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64597",
"datePublished": "2026-08-06T07:13:52.117Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-08T15:13:27.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64596 (GCVE-0-2026-64596)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
Summary
In the Linux kernel, the following vulnerability has been resolved:
libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
Since commit 1e7ab6f67824 ("anon_inode: rework assertions"),
path_noexec() warns when an anonymous-inode file is mmap'd from a
superblock that has not set SB_I_NOEXEC. dma-buf backs its files this
way and never set the flag, so mmap of any exported buffer trips the
warning on a CONFIG_DEBUG_VFS=y kernel:
WARNING: CPU: 11 PID: 121813 at fs/exec.c:118 path_noexec+0x47/0x50
do_mmap+0x2b5/0x680
vm_mmap_pgoff+0x129/0x210
ksys_mmap_pgoff+0x177/0x240
__x64_sys_mmap+0x33/0x70
init_pseudo() sets up internal SB_NOUSER mounts that are never
path-reachable. Set both flags here so every pseudo filesystem gets
them by default instead of each caller setting them.
SB_I_NODEV is inert for unreachable mounts. SB_I_NOEXEC has one
visible effect: an executable mapping of a pseudo-fs fd, such as a
dma-buf, now fails with -EPERM, which is the invariant the assertion
enforces. No in-tree caller maps these executable.
Reproduce on CONFIG_DEBUG_VFS=y:
make -C tools/testing/selftests/dmabuf-heaps
sudo ./tools/testing/selftests/dmabuf-heaps/dmabuf-heap -t system
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1e7ab6f67824343ee3e96f100f0937c393749a8a , < b9d45d328fcda4f0d3d281b7d6f12d3f181d9381
(git)
Affected: 1e7ab6f67824343ee3e96f100f0937c393749a8a , < 8e931557b317f0fb414839fa51fae1d5feb0ad97 (git) Affected: 1e7ab6f67824343ee3e96f100f0937c393749a8a , < 6de2aeffabaafaeda819e60ec8d04f199711e11a (git) Affected: 9b8076a9404568d6cb6673b9a079558b15051966 (git) Affected: 6.15.6 , < 6.16 (semver) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/libfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b9d45d328fcda4f0d3d281b7d6f12d3f181d9381",
"status": "affected",
"version": "1e7ab6f67824343ee3e96f100f0937c393749a8a",
"versionType": "git"
},
{
"lessThan": "8e931557b317f0fb414839fa51fae1d5feb0ad97",
"status": "affected",
"version": "1e7ab6f67824343ee3e96f100f0937c393749a8a",
"versionType": "git"
},
{
"lessThan": "6de2aeffabaafaeda819e60ec8d04f199711e11a",
"status": "affected",
"version": "1e7ab6f67824343ee3e96f100f0937c393749a8a",
"versionType": "git"
},
{
"status": "affected",
"version": "9b8076a9404568d6cb6673b9a079558b15051966",
"versionType": "git"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/libfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()\n\nSince commit 1e7ab6f67824 (\"anon_inode: rework assertions\"),\npath_noexec() warns when an anonymous-inode file is mmap\u0027d from a\nsuperblock that has not set SB_I_NOEXEC. dma-buf backs its files this\nway and never set the flag, so mmap of any exported buffer trips the\nwarning on a CONFIG_DEBUG_VFS=y kernel:\n\n WARNING: CPU: 11 PID: 121813 at fs/exec.c:118 path_noexec+0x47/0x50\n do_mmap+0x2b5/0x680\n vm_mmap_pgoff+0x129/0x210\n ksys_mmap_pgoff+0x177/0x240\n __x64_sys_mmap+0x33/0x70\n\ninit_pseudo() sets up internal SB_NOUSER mounts that are never\npath-reachable. Set both flags here so every pseudo filesystem gets\nthem by default instead of each caller setting them.\n\nSB_I_NODEV is inert for unreachable mounts. SB_I_NOEXEC has one\nvisible effect: an executable mapping of a pseudo-fs fd, such as a\ndma-buf, now fails with -EPERM, which is the invariant the assertion\nenforces. No in-tree caller maps these executable.\n\nReproduce on CONFIG_DEBUG_VFS=y:\n\n make -C tools/testing/selftests/dmabuf-heaps\n sudo ./tools/testing/selftests/dmabuf-heaps/dmabuf-heap -t system"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:51.523Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b9d45d328fcda4f0d3d281b7d6f12d3f181d9381"
},
{
"url": "https://git.kernel.org/stable/c/8e931557b317f0fb414839fa51fae1d5feb0ad97"
},
{
"url": "https://git.kernel.org/stable/c/6de2aeffabaafaeda819e60ec8d04f199711e11a"
}
],
"title": "libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64596",
"datePublished": "2026-08-06T07:13:51.523Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:51.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64595 (GCVE-0-2026-64595)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it
to run 2 ms later:
INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup);
schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));
cfg_setup() dereferences drvdata.hdev to issue MCU command requests.
hid_go_cfg_remove() tears down sysfs and stops the HID device, but
never drains the delayed work. If the device is unbound within the
2 ms scheduling delay (a probe failure rolling back via remove, or a
fast rmmod after probe), the work fires after hid_destroy_device()
has dropped its reference and released the underlying hdev struct,
leaving cfg_setup() with a stale drvdata.hdev pointer.
Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()
already calls cancel_delayed_work_sync() on its analogous work, and
drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel
must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup()
acquires that mutex; reversing the order would deadlock.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d69ccfcbc9551988190895bc125a8bf709aa5931 , < 3e7761f7bf9f0187bb18cf52b5119bdf4940e686
(git)
Affected: d69ccfcbc9551988190895bc125a8bf709aa5931 , < 73fde0cbff7d9d618591774a12c23434232752c1 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-lenovo-go.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e7761f7bf9f0187bb18cf52b5119bdf4940e686",
"status": "affected",
"version": "d69ccfcbc9551988190895bc125a8bf709aa5931",
"versionType": "git"
},
{
"lessThan": "73fde0cbff7d9d618591774a12c23434232752c1",
"status": "affected",
"version": "d69ccfcbc9551988190895bc125a8bf709aa5931",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-lenovo-go.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()\n\nhid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it\nto run 2 ms later:\n\n INIT_DELAYED_WORK(\u0026drvdata.go_cfg_setup, \u0026cfg_setup);\n schedule_delayed_work(\u0026drvdata.go_cfg_setup, msecs_to_jiffies(2));\n\ncfg_setup() dereferences drvdata.hdev to issue MCU command requests.\nhid_go_cfg_remove() tears down sysfs and stops the HID device, but\nnever drains the delayed work. If the device is unbound within the\n2 ms scheduling delay (a probe failure rolling back via remove, or a\nfast rmmod after probe), the work fires after hid_destroy_device()\nhas dropped its reference and released the underlying hdev struct,\nleaving cfg_setup() with a stale drvdata.hdev pointer.\n\nMirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()\nalready calls cancel_delayed_work_sync() on its analogous work, and\ndrain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel\nmust come before guard(mutex)(\u0026drvdata.cfg_mutex) because cfg_setup()\nacquires that mutex; reversing the order would deadlock."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:50.918Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e7761f7bf9f0187bb18cf52b5119bdf4940e686"
},
{
"url": "https://git.kernel.org/stable/c/73fde0cbff7d9d618591774a12c23434232752c1"
}
],
"title": "HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64595",
"datePublished": "2026-08-06T07:13:50.918Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:50.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64594 (GCVE-0-2026-64594)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
usb: gadget: f_fs: initialize reset_work at allocation time
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: initialize reset_work at allocation time
ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on
ffs->reset_work when a functionfs instance is unmounted:
ffs_data_reset(ffs);
cancel_work_sync(&ffs->reset_work);
However ffs->reset_work is only ever initialized via INIT_WORK() in
ffs_func_set_alt() and ffs_func_disable(), and only on the
FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed()
when the instance is mounted with the "no_disconnect" option, so for the
common case (no "no_disconnect", or mounted and unmounted without ever
being deactivated) reset_work is never initialized.
ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not
initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch
it either, so reset_work.func is left NULL. cancel_work_sync() on such a
work then trips the WARN_ON(!work->func) guard in __flush_work():
WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount
Call trace:
__flush_work
cancel_work_sync
ffs_fs_kill_sb [usb_f_fs]
deactivate_locked_super
deactivate_super
cleanup_mnt
__cleanup_mnt
task_work_run
exit_to_user_mode_loop
el0_svc
On older kernels cancel_work_sync() on a zero-initialized work struct was
a silent no-op, which hid the missing initialization.
Initialize reset_work once in ffs_data_new() so it is always valid for
the lifetime of the ffs_data, and drop the now-redundant INIT_WORK()
calls from the two deactivation paths.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
18d6b32fca3841f7cd9479b4024abd8a9b299281 , < 7fe895e0a9651518c4fc082487da770ff9c14c7f
(git)
Affected: 18d6b32fca3841f7cd9479b4024abd8a9b299281 , < 0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7 (git) Affected: 18d6b32fca3841f7cd9479b4024abd8a9b299281 , < cb19e54ebe9baf3c3243083ade65c937339ccb7b (git) Affected: 18d6b32fca3841f7cd9479b4024abd8a9b299281 , < d5631081be07f20e764d3cb5c98ac0a1004fba51 (git) Affected: 18d6b32fca3841f7cd9479b4024abd8a9b299281 , < c36393b0d14e1e9783888f821ffe29381b8f46dc (git) Affected: 18d6b32fca3841f7cd9479b4024abd8a9b299281 , < 69faa3779250df14f51d5084f938a99809546e52 (git) Affected: 18d6b32fca3841f7cd9479b4024abd8a9b299281 , < ba1867999dbc4085e6d8c52ac5266005b8b2bf07 (git) Affected: 18d6b32fca3841f7cd9479b4024abd8a9b299281 , < 3137b243c93982fe3460335e12f9247739766e10 (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7fe895e0a9651518c4fc082487da770ff9c14c7f",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
},
{
"lessThan": "0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
},
{
"lessThan": "cb19e54ebe9baf3c3243083ade65c937339ccb7b",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
},
{
"lessThan": "d5631081be07f20e764d3cb5c98ac0a1004fba51",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
},
{
"lessThan": "c36393b0d14e1e9783888f821ffe29381b8f46dc",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
},
{
"lessThan": "69faa3779250df14f51d5084f938a99809546e52",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
},
{
"lessThan": "ba1867999dbc4085e6d8c52ac5266005b8b2bf07",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
},
{
"lessThan": "3137b243c93982fe3460335e12f9247739766e10",
"status": "affected",
"version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: initialize reset_work at allocation time\n\nffs_fs_kill_sb() unconditionally calls cancel_work_sync() on\nffs-\u003ereset_work when a functionfs instance is unmounted:\n\n\tffs_data_reset(ffs);\n\tcancel_work_sync(\u0026ffs-\u003ereset_work);\n\nHowever ffs-\u003ereset_work is only ever initialized via INIT_WORK() in\nffs_func_set_alt() and ffs_func_disable(), and only on the\nFFS_DEACTIVATED path. That state is reached solely by ffs_data_closed()\nwhen the instance is mounted with the \"no_disconnect\" option, so for the\ncommon case (no \"no_disconnect\", or mounted and unmounted without ever\nbeing deactivated) reset_work is never initialized.\n\nffs_data_new() allocates the ffs_data with kzalloc_obj() and does not\ninitialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch\nit either, so reset_work.func is left NULL. cancel_work_sync() on such a\nwork then trips the WARN_ON(!work-\u003efunc) guard in __flush_work():\n\n WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount\n Call trace:\n __flush_work\n cancel_work_sync\n ffs_fs_kill_sb [usb_f_fs]\n deactivate_locked_super\n deactivate_super\n cleanup_mnt\n __cleanup_mnt\n task_work_run\n exit_to_user_mode_loop\n el0_svc\n\nOn older kernels cancel_work_sync() on a zero-initialized work struct was\na silent no-op, which hid the missing initialization.\n\nInitialize reset_work once in ffs_data_new() so it is always valid for\nthe lifetime of the ffs_data, and drop the now-redundant INIT_WORK()\ncalls from the two deactivation paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:50.309Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7fe895e0a9651518c4fc082487da770ff9c14c7f"
},
{
"url": "https://git.kernel.org/stable/c/0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7"
},
{
"url": "https://git.kernel.org/stable/c/cb19e54ebe9baf3c3243083ade65c937339ccb7b"
},
{
"url": "https://git.kernel.org/stable/c/d5631081be07f20e764d3cb5c98ac0a1004fba51"
},
{
"url": "https://git.kernel.org/stable/c/c36393b0d14e1e9783888f821ffe29381b8f46dc"
},
{
"url": "https://git.kernel.org/stable/c/69faa3779250df14f51d5084f938a99809546e52"
},
{
"url": "https://git.kernel.org/stable/c/ba1867999dbc4085e6d8c52ac5266005b8b2bf07"
},
{
"url": "https://git.kernel.org/stable/c/3137b243c93982fe3460335e12f9247739766e10"
}
],
"title": "usb: gadget: f_fs: initialize reset_work at allocation time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64594",
"datePublished": "2026-08-06T07:13:50.309Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:50.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64593 (GCVE-0-2026-64593)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
btrfs: do not trim a device which is not writeable
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not trim a device which is not writeable
[BUG]
There is a bug report that btrfs/242 can randomly fail with the
following NULL pointer dereference:
run fstests btrfs/242 at 2026-06-01 10:25:08
BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
BTRFS info (device sdc): using crc32c checksum algorithm
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS info (device sdc): allowing degraded mounts
BTRFS info (device sdc): turning on async discard
BTRFS info (device sdc): enabling free space tree
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
Call trace:
btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
__arm64_sys_ioctl+0xac/0x108
invoke_syscall.constprop.0+0x5c/0xd0
el0_svc_common.constprop.0+0x40/0xf0
do_el0_svc+0x24/0x40
el0_svc+0x40/0x1d0
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
---[ end trace 0000000000000000 ]---
Also the reporter is very kind to test the following ASSERT() added to
btrfs_trim_free_extents_throttle():
ASSERT(device->bdev,
"devid=%llu path=%s dev_state=0x%lx\n",
device->devid, btrfs_dev_name(device), device->dev_state);
And it shows the following output:
assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)
Which means the device->bdev is NULL, and the dev_state is
BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
BTRFS_DEV_STATE_WRITEABLE flag set.
[CAUSE]
The pc points to the following call chain:
btrfs_trim_fs()
|- btrfs_trim_free_extents()
|- btrfs_trim_free_extents_throttle()
|- bdev_max_discard_sectors(device->bdev)
So the NULL pointer dereference is caused by device->bdev being NULL.
This looks impossible by a quick glance, as just before calling
btrfs_trim_free_extents_throttle(), we have skipped any device that has
BTRFS_DEV_STATE_MISSING flag set.
However in this particular case, there is a window where the missing
device is later re-scanned, causing btrfs to remove the
BTRFS_DEV_STATE_MISSING flag:
btrfs_control_ioctl()
|- btrfs_scan_one_device()
|- device_list_add()
|- rcu_assign_pointer(device->name, name);
| This updates the missing device's path to the new good path.
|
|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
This removes the BTRFS_DEV_STATE_MISSING flag.
This allows the missing device to re-appear and clear the
BTRFS_DEV_STATE_MISSING flag. However the device still does not have
the BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.
The bdev pointer remains NULL, triggering the crash later.
[FIX]
This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
device->bdev pointer, and shows a gap in btrfs's re-appearing-device
handling.
The proper handling of re-appearing device will need quite some extra
work, which is out of the context of this small
---truncated---
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
499f377f49f085ee4aa214c738e948e88626f39b , < f41ae7e6664f3c4361129728f2c4d5f3ed995251
(git)
Affected: 499f377f49f085ee4aa214c738e948e88626f39b , < 210af872eafa0cf572a84cb303c0f9d2914c1226 (git) Affected: 499f377f49f085ee4aa214c738e948e88626f39b , < 3d8fa4b828a86b33c60858e58aaab6df273ede05 (git) Affected: 499f377f49f085ee4aa214c738e948e88626f39b , < 9c894159c5b8adc84072e3af0e55b0473a69564e (git) Affected: 499f377f49f085ee4aa214c738e948e88626f39b , < 02c903fc6fc7e16c5d1f22d18784f1208acf43e3 (git) Affected: 499f377f49f085ee4aa214c738e948e88626f39b , < 7a64521802997257b144e6edfb4e278dbeb972dd (git) Affected: 499f377f49f085ee4aa214c738e948e88626f39b , < b4af31b898a948e29861cb0bae734058f9a49d9b (git) Affected: 499f377f49f085ee4aa214c738e948e88626f39b , < 1b1937eb08f51319bf71575484cde2b8c517aedc (git) |
|
| Linux | Linux |
Affected:
4.3
Unaffected: 0 , < 4.3 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent-tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f41ae7e6664f3c4361129728f2c4d5f3ed995251",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "210af872eafa0cf572a84cb303c0f9d2914c1226",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "3d8fa4b828a86b33c60858e58aaab6df273ede05",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "9c894159c5b8adc84072e3af0e55b0473a69564e",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "02c903fc6fc7e16c5d1f22d18784f1208acf43e3",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "7a64521802997257b144e6edfb4e278dbeb972dd",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "b4af31b898a948e29861cb0bae734058f9a49d9b",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "1b1937eb08f51319bf71575484cde2b8c517aedc",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent-tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not trim a device which is not writeable\n\n[BUG]\nThere is a bug report that btrfs/242 can randomly fail with the\nfollowing NULL pointer dereference:\n\n run fstests btrfs/242 at 2026-06-01 10:25:08\n BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)\n BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874\n BTRFS info (device sdc): using crc32c checksum algorithm\n BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing\n BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing\n BTRFS info (device sdc): allowing degraded mounts\n BTRFS info (device sdc): turning on async discard\n BTRFS info (device sdc): enabling free space tree\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000\n CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025\n pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]\n lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]\n Call trace:\n btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)\n btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]\n btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]\n __arm64_sys_ioctl+0xac/0x108\n invoke_syscall.constprop.0+0x5c/0xd0\n el0_svc_common.constprop.0+0x40/0xf0\n do_el0_svc+0x24/0x40\n el0_svc+0x40/0x1d0\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)\n ---[ end trace 0000000000000000 ]---\n\nAlso the reporter is very kind to test the following ASSERT() added to\nbtrfs_trim_free_extents_throttle():\n\n\tASSERT(device-\u003ebdev,\n\t \"devid=%llu path=%s dev_state=0x%lx\\n\",\n\t device-\u003edevid, btrfs_dev_name(device), device-\u003edev_state);\n\nAnd it shows the following output:\n\n assertion failed: device-\u003ebdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)\n\nWhich means the device-\u003ebdev is NULL, and the dev_state is\nBTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without\nBTRFS_DEV_STATE_WRITEABLE flag set.\n\n[CAUSE]\nThe pc points to the following call chain:\n\n btrfs_trim_fs()\n |- btrfs_trim_free_extents()\n |- btrfs_trim_free_extents_throttle()\n |- bdev_max_discard_sectors(device-\u003ebdev)\n\nSo the NULL pointer dereference is caused by device-\u003ebdev being NULL.\n\nThis looks impossible by a quick glance, as just before calling\nbtrfs_trim_free_extents_throttle(), we have skipped any device that has\nBTRFS_DEV_STATE_MISSING flag set.\n\nHowever in this particular case, there is a window where the missing\ndevice is later re-scanned, causing btrfs to remove the\nBTRFS_DEV_STATE_MISSING flag:\n\n btrfs_control_ioctl()\n |- btrfs_scan_one_device()\n |- device_list_add()\n |- rcu_assign_pointer(device-\u003ename, name);\n | This updates the missing device\u0027s path to the new good path.\n |\n |- clear_bit(BTRFS_DEV_STATE_MISSING, \u0026device-\u003edev_state)\n This removes the BTRFS_DEV_STATE_MISSING flag.\n\nThis allows the missing device to re-appear and clear the\nBTRFS_DEV_STATE_MISSING flag. However the device still does not have\nthe BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.\n\nThe bdev pointer remains NULL, triggering the crash later.\n\n[FIX]\nThis is a big de-synchronization between BTRFS_DEV_STATE_MISSING and\ndevice-\u003ebdev pointer, and shows a gap in btrfs\u0027s re-appearing-device\nhandling.\n\nThe proper handling of re-appearing device will need quite some extra\nwork, which is out of the context of this small\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:49.700Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f41ae7e6664f3c4361129728f2c4d5f3ed995251"
},
{
"url": "https://git.kernel.org/stable/c/210af872eafa0cf572a84cb303c0f9d2914c1226"
},
{
"url": "https://git.kernel.org/stable/c/3d8fa4b828a86b33c60858e58aaab6df273ede05"
},
{
"url": "https://git.kernel.org/stable/c/9c894159c5b8adc84072e3af0e55b0473a69564e"
},
{
"url": "https://git.kernel.org/stable/c/02c903fc6fc7e16c5d1f22d18784f1208acf43e3"
},
{
"url": "https://git.kernel.org/stable/c/7a64521802997257b144e6edfb4e278dbeb972dd"
},
{
"url": "https://git.kernel.org/stable/c/b4af31b898a948e29861cb0bae734058f9a49d9b"
},
{
"url": "https://git.kernel.org/stable/c/1b1937eb08f51319bf71575484cde2b8c517aedc"
}
],
"title": "btrfs: do not trim a device which is not writeable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64593",
"datePublished": "2026-08-06T07:13:49.700Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:49.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64592 (GCVE-0-2026-64592)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
riscv: mm: Unconditionally sfence.vma for spurious fault
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: mm: Unconditionally sfence.vma for spurious fault
Svvptc does not guarantee that it's safe to just return here. Since we
have already cleared our bit, if, theoretically, the bounded timeframe
for the accessed page to become valid still hasn't happened after sret,
we could fault again and actually crash.
Hopefully, these spurious faults should be rare enough that this is an
acceptable slowdown.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
503638e0babf364061bc50fca5103b00a56cc50a , < c4df24702bfc3cd2bed7746b94dc6139a3fa5428
(git)
Affected: 503638e0babf364061bc50fca5103b00a56cc50a , < 4d730cab96e6b75e4a07c4baf37294ebc07f795e (git) Affected: 503638e0babf364061bc50fca5103b00a56cc50a , < ede985ff4b569ed2454024f8bb107a6729fe08aa (git) Affected: 503638e0babf364061bc50fca5103b00a56cc50a , < 1b2c6b56a9fa0dcbef461039937de22b1cbecc7d (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/entry.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4df24702bfc3cd2bed7746b94dc6139a3fa5428",
"status": "affected",
"version": "503638e0babf364061bc50fca5103b00a56cc50a",
"versionType": "git"
},
{
"lessThan": "4d730cab96e6b75e4a07c4baf37294ebc07f795e",
"status": "affected",
"version": "503638e0babf364061bc50fca5103b00a56cc50a",
"versionType": "git"
},
{
"lessThan": "ede985ff4b569ed2454024f8bb107a6729fe08aa",
"status": "affected",
"version": "503638e0babf364061bc50fca5103b00a56cc50a",
"versionType": "git"
},
{
"lessThan": "1b2c6b56a9fa0dcbef461039937de22b1cbecc7d",
"status": "affected",
"version": "503638e0babf364061bc50fca5103b00a56cc50a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/entry.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: mm: Unconditionally sfence.vma for spurious fault\n\nSvvptc does not guarantee that it\u0027s safe to just return here. Since we\nhave already cleared our bit, if, theoretically, the bounded timeframe\nfor the accessed page to become valid still hasn\u0027t happened after sret,\nwe could fault again and actually crash.\n\nHopefully, these spurious faults should be rare enough that this is an\nacceptable slowdown."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:49.098Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c4df24702bfc3cd2bed7746b94dc6139a3fa5428"
},
{
"url": "https://git.kernel.org/stable/c/4d730cab96e6b75e4a07c4baf37294ebc07f795e"
},
{
"url": "https://git.kernel.org/stable/c/ede985ff4b569ed2454024f8bb107a6729fe08aa"
},
{
"url": "https://git.kernel.org/stable/c/1b2c6b56a9fa0dcbef461039937de22b1cbecc7d"
}
],
"title": "riscv: mm: Unconditionally sfence.vma for spurious fault",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64592",
"datePublished": "2026-08-06T07:13:49.098Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-06T07:13:49.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64591 (GCVE-0-2026-64591)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
iommu/vt-d: Avoid WARNING in sva unbind path
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Avoid WARNING in sva unbind path
The Intel IOMMU driver allows SVA on devices even if they do not support
PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when
PRI is supported") modified the SVA bind path to allow this configuration
by skipping IOPF enablement when PRI is missing. However, it failed to
update the unbind path.
This creates an imbalance: the unbind path attempts to disable IOPF for
a device that never had it enabled, triggering a WARNING in
intel_iommu_disable_iopf():
WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d
Call Trace:
<TASK>
blocking_domain_set_dev_pasid+0x50/0x70
iommu_detach_device_pasid+0x89/0xc0
iommu_sva_unbind_device+0x73/0x150
xe_vm_close_and_put+0x4d2/0x1200 [xe]
Fix this by bypassing IOPF operations for SVA domains on non-PRI hardware
in both the bind and unbind paths.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ee312bb1052e45cbccaf6abac1012db9ca43150a , < bb354384f40bb087e7c44f0f0743a23fc945f91d
(git)
Affected: 39c20c4e83b9f78988541d829aa34668904e54a0 , < 477f8dec3b5ae54e8ef3c33bdd2257e47896512e (git) Affected: 39c20c4e83b9f78988541d829aa34668904e54a0 , < 534b5f98ab7319d8004bbc7dab6481462243e883 (git) Affected: 46461dabb95239aa05e31e247cd21151b8406642 (git) Affected: 6.18.20 , < 6.18.39 (semver) Affected: 6.19.10 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.h",
"drivers/iommu/intel/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb354384f40bb087e7c44f0f0743a23fc945f91d",
"status": "affected",
"version": "ee312bb1052e45cbccaf6abac1012db9ca43150a",
"versionType": "git"
},
{
"lessThan": "477f8dec3b5ae54e8ef3c33bdd2257e47896512e",
"status": "affected",
"version": "39c20c4e83b9f78988541d829aa34668904e54a0",
"versionType": "git"
},
{
"lessThan": "534b5f98ab7319d8004bbc7dab6481462243e883",
"status": "affected",
"version": "39c20c4e83b9f78988541d829aa34668904e54a0",
"versionType": "git"
},
{
"status": "affected",
"version": "46461dabb95239aa05e31e247cd21151b8406642",
"versionType": "git"
},
{
"lessThan": "6.18.39",
"status": "affected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.h",
"drivers/iommu/intel/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.18.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Avoid WARNING in sva unbind path\n\nThe Intel IOMMU driver allows SVA on devices even if they do not support\nPCI/PRI. Commit 39c20c4e83b9 (\"iommu/vt-d: Only handle IOPF for SVA when\nPRI is supported\") modified the SVA bind path to allow this configuration\nby skipping IOPF enablement when PRI is missing. However, it failed to\nupdate the unbind path.\n\nThis creates an imbalance: the unbind path attempts to disable IOPF for\na device that never had it enabled, triggering a WARNING in\nintel_iommu_disable_iopf():\n\n WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d\n Call Trace:\n \u003cTASK\u003e\n blocking_domain_set_dev_pasid+0x50/0x70\n iommu_detach_device_pasid+0x89/0xc0\n iommu_sva_unbind_device+0x73/0x150\n xe_vm_close_and_put+0x4d2/0x1200 [xe]\n\nFix this by bypassing IOPF operations for SVA domains on non-PRI hardware\nin both the bind and unbind paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:48.490Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb354384f40bb087e7c44f0f0743a23fc945f91d"
},
{
"url": "https://git.kernel.org/stable/c/477f8dec3b5ae54e8ef3c33bdd2257e47896512e"
},
{
"url": "https://git.kernel.org/stable/c/534b5f98ab7319d8004bbc7dab6481462243e883"
}
],
"title": "iommu/vt-d: Avoid WARNING in sva unbind path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64591",
"datePublished": "2026-08-06T07:13:48.490Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-06T07:13:48.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64590 (GCVE-0-2026-64590)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
Summary
In the Linux kernel, the following vulnerability has been resolved:
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM
driver (e.g. amdgpu for video playback in GNOME Videos / Showtime)
triggers a spurious warning:
DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \
overlapping mappings aren't supported
WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0
The call chain is:
amdgpu_cs_ioctl
-> amdgpu_ttm_backend_bind
-> dma_buf_map_attachment
-> [udmabuf] map_udmabuf -> get_sg_table
-> dma_map_sgtable(dev, sg, direction, 0) // attrs=0
-> debug_dma_map_sg -> add_dma_entry -> EEXIST
This happens because udmabuf builds a per-page scatter-gather list via
sg_set_folio(). When begin_cpu_udmabuf() has already created an sg
table mapped for the misc device, and an importer such as amdgpu maps
the same pages for its own device via map_udmabuf(), the DMA debug
infrastructure sees two active mappings whose physical addresses share
cacheline boundaries and warns about the overlap.
The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in
add_dma_entry() because it signals that no CPU cache maintenance is
performed at map/unmap time, making the cacheline overlap harmless.
All other major dma-buf exporters already pass this flag:
- drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC
- amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC
The CPU sync at map/unmap time is also redundant for udmabuf:
begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit
cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU
access is requested through the dma-buf interface.
Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and
dma_unmap_sgtable() in udmabuf to suppress the spurious warning and
skip the redundant sync.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
284562e1f34874e267d4f499362c3816f8f6bc3f , < 0db56e7eae932f8e2f3eb44ad1a63633d8f504f8
(git)
Affected: 284562e1f34874e267d4f499362c3816f8f6bc3f , < d6552f5cff795d60e629f37513ecf23d88fd2f82 (git) Affected: 284562e1f34874e267d4f499362c3816f8f6bc3f , < 34696563461c9a23177feb6d8aff43f4c0510278 (git) Affected: 284562e1f34874e267d4f499362c3816f8f6bc3f , < 0449a6583c0ee76778d314e4e82f166fc97fa9d8 (git) Affected: 284562e1f34874e267d4f499362c3816f8f6bc3f , < 504e2b4ab97a51d56d966cd36d0997ad30b65b2d (git) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma-buf/udmabuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0db56e7eae932f8e2f3eb44ad1a63633d8f504f8",
"status": "affected",
"version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
"versionType": "git"
},
{
"lessThan": "d6552f5cff795d60e629f37513ecf23d88fd2f82",
"status": "affected",
"version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
"versionType": "git"
},
{
"lessThan": "34696563461c9a23177feb6d8aff43f4c0510278",
"status": "affected",
"version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
"versionType": "git"
},
{
"lessThan": "0449a6583c0ee76778d314e4e82f166fc97fa9d8",
"status": "affected",
"version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
"versionType": "git"
},
{
"lessThan": "504e2b4ab97a51d56d966cd36d0997ad30b65b2d",
"status": "affected",
"version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma-buf/udmabuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning\n\nWhen CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM\ndriver (e.g. amdgpu for video playback in GNOME Videos / Showtime)\ntriggers a spurious warning:\n\n DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \\\n overlapping mappings aren\u0027t supported\n WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0\n\nThe call chain is:\n\n amdgpu_cs_ioctl\n -\u003e amdgpu_ttm_backend_bind\n -\u003e dma_buf_map_attachment\n -\u003e [udmabuf] map_udmabuf -\u003e get_sg_table\n -\u003e dma_map_sgtable(dev, sg, direction, 0) // attrs=0\n -\u003e debug_dma_map_sg -\u003e add_dma_entry -\u003e EEXIST\n\nThis happens because udmabuf builds a per-page scatter-gather list via\nsg_set_folio(). When begin_cpu_udmabuf() has already created an sg\ntable mapped for the misc device, and an importer such as amdgpu maps\nthe same pages for its own device via map_udmabuf(), the DMA debug\ninfrastructure sees two active mappings whose physical addresses share\ncacheline boundaries and warns about the overlap.\n\nThe DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in\nadd_dma_entry() because it signals that no CPU cache maintenance is\nperformed at map/unmap time, making the cacheline overlap harmless.\n\nAll other major dma-buf exporters already pass this flag:\n - drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC\n - amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC\n\nThe CPU sync at map/unmap time is also redundant for udmabuf:\nbegin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit\ncache synchronization via dma_sync_sgtable_for_cpu/device() when CPU\naccess is requested through the dma-buf interface.\n\nPass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and\ndma_unmap_sgtable() in udmabuf to suppress the spurious warning and\nskip the redundant sync."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:47.888Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0db56e7eae932f8e2f3eb44ad1a63633d8f504f8"
},
{
"url": "https://git.kernel.org/stable/c/d6552f5cff795d60e629f37513ecf23d88fd2f82"
},
{
"url": "https://git.kernel.org/stable/c/34696563461c9a23177feb6d8aff43f4c0510278"
},
{
"url": "https://git.kernel.org/stable/c/0449a6583c0ee76778d314e4e82f166fc97fa9d8"
},
{
"url": "https://git.kernel.org/stable/c/504e2b4ab97a51d56d966cd36d0997ad30b65b2d"
}
],
"title": "dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64590",
"datePublished": "2026-08-06T07:13:47.888Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-06T07:13:47.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64589 (GCVE-0-2026-64589)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
i2c: core: fix NULL-deref on adapter registration failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix NULL-deref on adapter registration failure
If adapter registration ever fails the release callback would trigger a
NULL-pointer dereference as the completion struct has not been
initialised.
Note that before the offending commit this would instead have resulted
in a minor memory leak of the adapter name.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e19f31169f85c712c9fca35bfd28ceb093a9f574 , < 2ce0a74bfa3acdfcdb00cf02f181f2754b451f42
(git)
Affected: 3f8c4f5e9a57868fa107016c81165686d23325f2 , < 3351c5e77749a0c8a1e252b95420c143ebcf07ac (git) Affected: 3f8c4f5e9a57868fa107016c81165686d23325f2 , < 034e307428119b67f5f18a35e4f4e7d15a2b9774 (git) Affected: 3f8c4f5e9a57868fa107016c81165686d23325f2 , < 2295d2bb101faa663fbc45fadbb3fec45f107441 (git) Affected: 6.12.11 , < 6.12.96 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-core-base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ce0a74bfa3acdfcdb00cf02f181f2754b451f42",
"status": "affected",
"version": "e19f31169f85c712c9fca35bfd28ceb093a9f574",
"versionType": "git"
},
{
"lessThan": "3351c5e77749a0c8a1e252b95420c143ebcf07ac",
"status": "affected",
"version": "3f8c4f5e9a57868fa107016c81165686d23325f2",
"versionType": "git"
},
{
"lessThan": "034e307428119b67f5f18a35e4f4e7d15a2b9774",
"status": "affected",
"version": "3f8c4f5e9a57868fa107016c81165686d23325f2",
"versionType": "git"
},
{
"lessThan": "2295d2bb101faa663fbc45fadbb3fec45f107441",
"status": "affected",
"version": "3f8c4f5e9a57868fa107016c81165686d23325f2",
"versionType": "git"
},
{
"lessThan": "6.12.96",
"status": "affected",
"version": "6.12.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-core-base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix NULL-deref on adapter registration failure\n\nIf adapter registration ever fails the release callback would trigger a\nNULL-pointer dereference as the completion struct has not been\ninitialised.\n\nNote that before the offending commit this would instead have resulted\nin a minor memory leak of the adapter name."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:47.291Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ce0a74bfa3acdfcdb00cf02f181f2754b451f42"
},
{
"url": "https://git.kernel.org/stable/c/3351c5e77749a0c8a1e252b95420c143ebcf07ac"
},
{
"url": "https://git.kernel.org/stable/c/034e307428119b67f5f18a35e4f4e7d15a2b9774"
},
{
"url": "https://git.kernel.org/stable/c/2295d2bb101faa663fbc45fadbb3fec45f107441"
}
],
"title": "i2c: core: fix NULL-deref on adapter registration failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64589",
"datePublished": "2026-08-06T07:13:47.291Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-06T07:13:47.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64588 (GCVE-0-2026-64588)
Vulnerability from nvd – Published: 2026-08-06 07:13 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
fuse-uring: fix data races on ring->ready
Summary
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix data races on ring->ready
On weakly-ordered architectures, the store to fiq->ops can be
reordered past the store to ring->ready, allowing a CPU that sees
ring->ready == true via fuse_uring_ready() to dispatch requests
through a stale fiq->ops pointer. Upgrade the store to
smp_store_release() and the load in fuse_uring_ready() to
smp_load_acquire() so that the preceding WRITE_ONCE(fiq->ops, ...)
is visible to any CPU that observes ring->ready == true.
Additionally, fuse_uring_do_register() publishes ring->ready with
WRITE_ONCE() but the fast-path check reads it with a plain load.
This is a marked-vs-unmarked access that KCSAN will flag. Wrap it in
READ_ONCE() to mark it without adding unnecessary ordering.
Also wrap the fc->ring load in fuse_uring_ready() in READ_ONCE() to
prevent the compiler from reloading it between the NULL check and the
dereference.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c2c9af9a0b13261c36909036057a116f2edb5e1a , < b156bb9966972122b148acab8bdf415cdb8176a3
(git)
Affected: c2c9af9a0b13261c36909036057a116f2edb5e1a , < d01a09b442cb786cd44ccc7c84d57e2856d6737c (git) Affected: c2c9af9a0b13261c36909036057a116f2edb5e1a , < 46725a0056c884cf58a6897f222892807327d82d (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev_uring.c",
"fs/fuse/dev_uring_i.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b156bb9966972122b148acab8bdf415cdb8176a3",
"status": "affected",
"version": "c2c9af9a0b13261c36909036057a116f2edb5e1a",
"versionType": "git"
},
{
"lessThan": "d01a09b442cb786cd44ccc7c84d57e2856d6737c",
"status": "affected",
"version": "c2c9af9a0b13261c36909036057a116f2edb5e1a",
"versionType": "git"
},
{
"lessThan": "46725a0056c884cf58a6897f222892807327d82d",
"status": "affected",
"version": "c2c9af9a0b13261c36909036057a116f2edb5e1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev_uring.c",
"fs/fuse/dev_uring_i.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: fix data races on ring-\u003eready\n\nOn weakly-ordered architectures, the store to fiq-\u003eops can be\nreordered past the store to ring-\u003eready, allowing a CPU that sees\nring-\u003eready == true via fuse_uring_ready() to dispatch requests\nthrough a stale fiq-\u003eops pointer. Upgrade the store to\nsmp_store_release() and the load in fuse_uring_ready() to\nsmp_load_acquire() so that the preceding WRITE_ONCE(fiq-\u003eops, ...)\nis visible to any CPU that observes ring-\u003eready == true.\n\nAdditionally, fuse_uring_do_register() publishes ring-\u003eready with\nWRITE_ONCE() but the fast-path check reads it with a plain load.\nThis is a marked-vs-unmarked access that KCSAN will flag. Wrap it in\nREAD_ONCE() to mark it without adding unnecessary ordering.\n\nAlso wrap the fc-\u003ering load in fuse_uring_ready() in READ_ONCE() to\nprevent the compiler from reloading it between the NULL check and the\ndereference."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached locally by mounting FUSE with io-uring and submitting IORING_OP_URING_CMD registration while other local threads generate FUSE requests; no network protocol path invokes fuse_uring_ready() or fuse_uring_do_register().\nAC:L - The attacker controls both sides of the race by registering ring entries on /dev/fuse while concurrently issuing filesystem operations on the same mount, so the publish window on weakly ordered CPUs can be driven and retried without relying on victim state.\nPR:L - FUSE is FS_USERNS_MOUNT, so an ordinary user can create a user-namespace mount, open /dev/fuse, and enable FUSE_OVER_IO_URING without init-namespace root privileges.\nUI:N - The attacker can run both the FUSE daemon that registers io-uring queues and the client threads that generate requests on that mount, so no separate victim action is required.\nS:U - Impact is confined to the host kernel authority as a local FUSE/io-uring memory-safety failure, not a VM, IOMMU, or guest-to-host boundary escape.\nC:H - Missing acquire on ring-\u003eready lets CPUs observe readiness while fiq-\u003eops and related ring publication are stale, and the unfixed fc-\u003ering reload in fuse_uring_ready() is a check-then-use UAF window against ring teardown, enabling disclosure of reclaimed kernel memory.\nI:H - Dispatching through inconsistent ops/ring state and the concurrent ring reload UAF allow writes and list/queue operations on stale or reallocated fuse_ring objects, which is exploitable for heap corruption and control-flow hijacking.\nA:H - The same races can NULL-dereference or use a freed fuse_ring in fuse_uring_task_to_queue()/fuse_uring_ready(), hang requests on the wrong queue path, and trigger WARN/oops or panic under panic_on_warn."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:25.994Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b156bb9966972122b148acab8bdf415cdb8176a3"
},
{
"url": "https://git.kernel.org/stable/c/d01a09b442cb786cd44ccc7c84d57e2856d6737c"
},
{
"url": "https://git.kernel.org/stable/c/46725a0056c884cf58a6897f222892807327d82d"
}
],
"title": "fuse-uring: fix data races on ring-\u003eready",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64588",
"datePublished": "2026-08-06T07:13:46.688Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-08T15:13:25.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64587 (GCVE-0-2026-64587)
Vulnerability from nvd – Published: 2026-08-06 07:06 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe
should not see interrupt delivery in the usual case. However, hardware may
still present stale or latched interrupt status left by firmware or the
bootloader.
If probe later unwinds after devm_request_irq() has installed the handler,
such a stale interrupt can still reach arc_emac_intr() during teardown and
race with release of the associated net_device.
Avoid that window by putting the device into a known quiescent state before
requesting the IRQ: disable all EMAC interrupt sources and clear any
pending EMAC interrupt status bits. This keeps the change hardware-focused
and minimal, while preventing spurious IRQ delivery from leftover state.
Severity
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < abd338da658d7faa8e26cfefc8f83f0066707564
(git)
Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 5f29dd540fe5ea3c826fc8ec759ba488b31f9707 (git) Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 6fc7449773748c7b904235a09a67054d78ab1172 (git) Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 81431da777924dddaefa5c9b0ca9da4a93f9df96 (git) Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < d0f2386f529807826e7404d40a245ee428f89f62 (git) Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 8efd5dcd31e22a9308b16b107a052fcd568c0a99 (git) Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 8f9adb3605e36f75639de529bb3d66e94194a388 (git) Affected: e4f2379db6c6823c5d4a4c2c912df00c65de51d7 , < 2503d08f8a2de618e5c3a8183b250ff4a2e2d52c (git) |
|
| Linux | Linux |
Affected:
3.11
Unaffected: 0 , < 3.11 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.78 , ≤ 6.12.* (semver) Unaffected: 6.18.19 , ≤ 6.18.* (semver) Unaffected: 6.19.9 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/arc/emac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "abd338da658d7faa8e26cfefc8f83f0066707564",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
},
{
"lessThan": "5f29dd540fe5ea3c826fc8ec759ba488b31f9707",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
},
{
"lessThan": "6fc7449773748c7b904235a09a67054d78ab1172",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
},
{
"lessThan": "81431da777924dddaefa5c9b0ca9da4a93f9df96",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
},
{
"lessThan": "d0f2386f529807826e7404d40a245ee428f89f62",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
},
{
"lessThan": "8efd5dcd31e22a9308b16b107a052fcd568c0a99",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
},
{
"lessThan": "8f9adb3605e36f75639de529bb3d66e94194a388",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
},
{
"lessThan": "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c",
"status": "affected",
"version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/arc/emac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n\nNormal RX/TX interrupts are enabled later, in arc_emac_open(), so probe\nshould not see interrupt delivery in the usual case. However, hardware may\nstill present stale or latched interrupt status left by firmware or the\nbootloader.\n\nIf probe later unwinds after devm_request_irq() has installed the handler,\nsuch a stale interrupt can still reach arc_emac_intr() during teardown and\nrace with release of the associated net_device.\n\nAvoid that window by putting the device into a known quiescent state before\nrequesting the IRQ: disable all EMAC interrupt sources and clear any\npending EMAC interrupt status bits. This keeps the change hardware-focused\nand minimal, while preventing spurious IRQ delivery from leftover state."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in ARC/Rockchip EMAC platform probe/teardown (arc_emac_probe \u2192 free_netdev while the devm IRQ remains), not in packet processing; a remote or adjacent peer cannot induce this path via Ethernet frames.\nAC:H - Exploitation needs leftover firmware/bootloader-latched EMAC IRQ state plus a post-request_irq probe failure overlapping interrupt delivery; the attacker does not control that hardware/firmware precondition or IRQ timing.\nPR:L - An unprivileged local user can drive post-request_irq failures such as dmam_alloc_coherent -ENOMEM via memory pressure during deferred probe after userspace is up; platform bind/unbind is root-only but is not required for this path.\nUI:N - No victim action is required; once leftover IRQ state exists, the attacker can induce probe failure and race teardown without another user opening or configuring the interface.\nS:U - Impact is use-after-free/corruption inside the host kernel EMAC interrupt path and does not cross a VM, IOMMU, or other separate security authority.\nC:H - arc_emac_intr can run on a freed or half-initialized net_device (netdev_priv, NAPI, stats), a use-after-free that can expose attacker-influenced kernel heap contents.\nI:H - The same UAF lets the IRQ handler write through reclaimed net_device/NAPI state (e.g. napi_schedule), enabling heap corruption and potential control-flow hijacking.\nA:H - Dereferencing freed or uninitialized NAPI/netdev state in IRQ context can oops or panic the kernel, causing full denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:24.903Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564"
},
{
"url": "https://git.kernel.org/stable/c/5f29dd540fe5ea3c826fc8ec759ba488b31f9707"
},
{
"url": "https://git.kernel.org/stable/c/6fc7449773748c7b904235a09a67054d78ab1172"
},
{
"url": "https://git.kernel.org/stable/c/81431da777924dddaefa5c9b0ca9da4a93f9df96"
},
{
"url": "https://git.kernel.org/stable/c/d0f2386f529807826e7404d40a245ee428f89f62"
},
{
"url": "https://git.kernel.org/stable/c/8efd5dcd31e22a9308b16b107a052fcd568c0a99"
},
{
"url": "https://git.kernel.org/stable/c/8f9adb3605e36f75639de529bb3d66e94194a388"
},
{
"url": "https://git.kernel.org/stable/c/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c"
}
],
"title": "net: ethernet: arc: emac: quiesce interrupts before requesting IRQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64587",
"datePublished": "2026-08-06T07:06:27.765Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-08T15:13:24.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64586 (GCVE-0-2026-64586)
Vulnerability from nvd – Published: 2026-08-06 07:06 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
wifi: brcmfmac: drain bus_reset work on device removal
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: drain bus_reset work on device removal
brcmf_fw_crashed() and the debugfs "reset" entry both schedule
drvr->bus_reset, whose callback recovers drvr through container_of()
and dereferences it. The removal path frees drvr (brcmf_free ->
wiphy_free) without draining the work, so a bus_reset callback pending
or running during removal can outlive drvr.
Cancellation cannot live in brcmf_detach() or brcmf_free(): the work
callback reaches teardown through the bus .reset op (PCIe
brcmf_pcie_reset -> brcmf_detach; SDIO brcmf_sdio_bus_reset ->
brcmf_sdiod_remove -> brcmf_free), so cancelling there would wait for
the running work and deadlock.
Add a per-bus mutex (bus_reset_lock) and route all arming through
brcmf_bus_schedule_reset(), which under the lock skips when the bus is
marked removing. Each bus remove entry calls
brcmf_bus_cancel_reset_work(), which under the same lock sets removing
and cancels the work. Holding the mutex across cancel_work_sync() makes
the set-removing + drain step atomic. Every producer reaches the arming
path from process context -- the PCIe firmware-halt notification runs in
the threaded IRQ handler (brcmf_pcie_isr_thread) and the SDIO hostmail
path runs from the data workqueue -- so the mutex is taken only in
sleepable contexts. Where applicable the remove entry first stops the
firmware-crash producer: on PCIe mask the mailbox and synchronize_irq;
on SDIO unregister the bus interrupt and cancel the data worker, which
also reports firmware halts through brcmf_fw_crashed(). The mutex is
initialized at bus allocation. The SDIO suspend power-off path frees
drvr through the same brcmf_sdiod_remove() and takes the same lock;
resume re-allows the work only on a successful re-probe.
Also guard brcmf_fw_crashed() against a NULL bus_if/drvr: it can fire
before brcmf_attach() wires up drvr, and it dereferences drvr
(bphy_err/brcmf_dev_coredump) before reaching the arming gate.
The bus_reset work is shared across buses, so the drain is applied to
every remove path: PCIe (the .reset op introduced by the Fixes commit),
SDIO (arms the same work through brcmf_fw_crashed()), and USB (via the
debugfs "reset" entry). cancel_work_sync() drains a running or pending
bus_reset work item before removal frees drvr, and patch 1/2 makes the
scratch-buffer release safe when reset teardown has already released
those DMA buffers.
This patch fixes the lifetime of the bus_reset work item itself. It does
not attempt to address the separate, pre-existing lifetime of the
asynchronous firmware completion started by the PCIe reset path. That
callback needs its own lifetime/ownership protocol and is being tracked
separately.
This issue was found by an in-house static analysis tool.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4684997d9eea29380000e062755aa6d368d789a3 , < 177a25be1195f8bdc6160ba5f1a5699f7041c985
(git)
Affected: 4684997d9eea29380000e062755aa6d368d789a3 , < 43b25879f004c98defa2776bedc6ca4763c51945 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "177a25be1195f8bdc6160ba5f1a5699f7041c985",
"status": "affected",
"version": "4684997d9eea29380000e062755aa6d368d789a3",
"versionType": "git"
},
{
"lessThan": "43b25879f004c98defa2776bedc6ca4763c51945",
"status": "affected",
"version": "4684997d9eea29380000e062755aa6d368d789a3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: drain bus_reset work on device removal\n\nbrcmf_fw_crashed() and the debugfs \"reset\" entry both schedule\ndrvr-\u003ebus_reset, whose callback recovers drvr through container_of()\nand dereferences it. The removal path frees drvr (brcmf_free -\u003e\nwiphy_free) without draining the work, so a bus_reset callback pending\nor running during removal can outlive drvr.\n\nCancellation cannot live in brcmf_detach() or brcmf_free(): the work\ncallback reaches teardown through the bus .reset op (PCIe\nbrcmf_pcie_reset -\u003e brcmf_detach; SDIO brcmf_sdio_bus_reset -\u003e\nbrcmf_sdiod_remove -\u003e brcmf_free), so cancelling there would wait for\nthe running work and deadlock.\n\nAdd a per-bus mutex (bus_reset_lock) and route all arming through\nbrcmf_bus_schedule_reset(), which under the lock skips when the bus is\nmarked removing. Each bus remove entry calls\nbrcmf_bus_cancel_reset_work(), which under the same lock sets removing\nand cancels the work. Holding the mutex across cancel_work_sync() makes\nthe set-removing + drain step atomic. Every producer reaches the arming\npath from process context -- the PCIe firmware-halt notification runs in\nthe threaded IRQ handler (brcmf_pcie_isr_thread) and the SDIO hostmail\npath runs from the data workqueue -- so the mutex is taken only in\nsleepable contexts. Where applicable the remove entry first stops the\nfirmware-crash producer: on PCIe mask the mailbox and synchronize_irq;\non SDIO unregister the bus interrupt and cancel the data worker, which\nalso reports firmware halts through brcmf_fw_crashed(). The mutex is\ninitialized at bus allocation. The SDIO suspend power-off path frees\ndrvr through the same brcmf_sdiod_remove() and takes the same lock;\nresume re-allows the work only on a successful re-probe.\n\nAlso guard brcmf_fw_crashed() against a NULL bus_if/drvr: it can fire\nbefore brcmf_attach() wires up drvr, and it dereferences drvr\n(bphy_err/brcmf_dev_coredump) before reaching the arming gate.\n\nThe bus_reset work is shared across buses, so the drain is applied to\nevery remove path: PCIe (the .reset op introduced by the Fixes commit),\nSDIO (arms the same work through brcmf_fw_crashed()), and USB (via the\ndebugfs \"reset\" entry). cancel_work_sync() drains a running or pending\nbus_reset work item before removal frees drvr, and patch 1/2 makes the\nscratch-buffer release safe when reset teardown has already released\nthose DMA buffers.\n\nThis patch fixes the lifetime of the bus_reset work item itself. It does\nnot attempt to address the separate, pre-existing lifetime of the\nasynchronous firmware completion started by the PCIe reset path. That\ncallback needs its own lifetime/ownership protocol and is being tracked\nseparately.\n\nThis issue was found by an in-house static analysis tool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - bus_reset is armed by brcmf_fw_crashed() when Broadcom fullmac signals FWHALT (PCIe mailbox ISR thread / SDIO hostmail). An adjacent 802.11 attacker can induce that halt with malformed frames; the pending work then races device removal (USB hot-unplug, SDIO suspend power-off) that frees drvr without draining the work.\nAC:L - The attacker repeatedly induces firmware halts to schedule bus_reset and can align removal (USB unplug on shared dongles/kiosks, or SDIO suspend) so the work runs after wiphy_free; both sides are attacker-influenced and freely retryable, so success does not depend on uncontrollable timing.\nPR:N - FWHALT delivery and brcmf_fw_crashed() need no host credentials; concurrent free via USB disconnect or automatic SDIO power-cut suspend likewise requires no account or capability. The debugfs reset path is root-only but is not the highest-severity reachability.\nUI:N - Firmware-halt recovery and device removal/suspend paths run in kernel workqueues and bus callbacks without the victim opening a file, mounting media, or otherwise interacting.\nS:U - The UAF corrupts host-kernel heap (struct brcmf_pub embedded in the wiphy) within the same kernel security authority; it is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Use-after-free of drvr via container_of on the freed bus_reset work_struct lets an attacker reallocate the wiphy/drvr slab and observe attacker-controlled object contents through subsequent driver dereferences, yielding an arbitrary kernel read primitive.\nI:H - The recycled work_struct/drvr is dispatched by the workqueue (func pointer / bus_if ops), enabling heap corruption and control-flow hijack when brcmf_core_bus_reset runs on attacker-shaped memory after brcmf_free/wiphy_free.\nA:H - Even without full exploitation, running bus_reset after wiphy_free dereferences freed drvr/bus_if state and reliably causes kernel oops/panic or driver teardown failure, denying availability of the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:23.814Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/177a25be1195f8bdc6160ba5f1a5699f7041c985"
},
{
"url": "https://git.kernel.org/stable/c/43b25879f004c98defa2776bedc6ca4763c51945"
}
],
"title": "wifi: brcmfmac: drain bus_reset work on device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64586",
"datePublished": "2026-08-06T07:06:27.158Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-08T15:13:23.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64585 (GCVE-0-2026-64585)
Vulnerability from nvd – Published: 2026-08-06 07:06 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
can: esd_usb: kill anchored URBs before freeing netdevs
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: esd_usb: kill anchored URBs before freeing netdevs
esd_usb_disconnect() frees each CAN netdev with free_candev() inside
its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.
The per-netdev private data (struct esd_usb_net_priv) is embedded in
the net_device allocation returned by alloc_candev(), so once
free_candev() has run, dev->nets[i] points to freed memory.
unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the
per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),
clear active_tx_jobs, and reset priv->tx_contexts[].
Reorder the teardown so the anchored URBs are killed before the netdevs
are freed, matching other CAN/USB drivers in the same directory such as
ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then
free: unregister the netdevs first (which stops their TX queues), call
unlink_all_urbs(dev) once, then free the netdevs.
This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
96d8e90382dc336b5de401164597edfdc2e8d9f1 , < aa1d005927db38af783c1a4a8a00a39e0229ab2d
(git)
Affected: 96d8e90382dc336b5de401164597edfdc2e8d9f1 , < a02e1d8f191324583599544d54e59e6a2b74bb0e (git) Affected: 96d8e90382dc336b5de401164597edfdc2e8d9f1 , < a3314f10369df70925140f59bbe069718f65a0b9 (git) Affected: 96d8e90382dc336b5de401164597edfdc2e8d9f1 , < 765ba1c91823a296447528791b89a6504947fd5c (git) Affected: 96d8e90382dc336b5de401164597edfdc2e8d9f1 , < 5832c55b3c824ba2fe9c36ac3c411baddcce053e (git) Affected: 96d8e90382dc336b5de401164597edfdc2e8d9f1 , < c43122fef328a70045fe7621c06de6b2b8e19264 (git) |
|
| Linux | Linux |
Affected:
2.6.36
Unaffected: 0 , < 2.6.36 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/esd_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aa1d005927db38af783c1a4a8a00a39e0229ab2d",
"status": "affected",
"version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
"versionType": "git"
},
{
"lessThan": "a02e1d8f191324583599544d54e59e6a2b74bb0e",
"status": "affected",
"version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
"versionType": "git"
},
{
"lessThan": "a3314f10369df70925140f59bbe069718f65a0b9",
"status": "affected",
"version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
"versionType": "git"
},
{
"lessThan": "765ba1c91823a296447528791b89a6504947fd5c",
"status": "affected",
"version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
"versionType": "git"
},
{
"lessThan": "5832c55b3c824ba2fe9c36ac3c411baddcce053e",
"status": "affected",
"version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
"versionType": "git"
},
{
"lessThan": "c43122fef328a70045fe7621c06de6b2b8e19264",
"status": "affected",
"version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/esd_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: esd_usb: kill anchored URBs before freeing netdevs\n\nesd_usb_disconnect() frees each CAN netdev with free_candev() inside\nits per-netdev loop and only calls unlink_all_urbs(dev) afterwards.\nThe per-netdev private data (struct esd_usb_net_priv) is embedded in\nthe net_device allocation returned by alloc_candev(), so once\nfree_candev() has run, dev-\u003enets[i] points to freed memory.\nunlink_all_urbs() then dereferences the freed dev-\u003enets[i] to kill the\nper-netdev TX anchor (usb_kill_anchored_urbs(\u0026priv-\u003etx_submitted)),\nclear active_tx_jobs, and reset priv-\u003etx_contexts[].\n\nReorder the teardown so the anchored URBs are killed before the netdevs\nare freed, matching other CAN/USB drivers in the same directory such as\nems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then\nfree: unregister the netdevs first (which stops their TX queues), call\nunlink_all_urbs(dev) once, then free the netdevs.\n\nThis issue was found by an in-house static analysis tool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached by forcing esd_usb_disconnect() via local usbfs USBDEVFS_DISCONNECT, sysfs unbind, or USB emulation, not by network/CAN traffic; this matches AV:L scoring of analogous USB disconnect UAFs (e.g. CVE-2025-40283).\nAC:L - Once disconnect runs, free_candev() then unlink_all_urbs() deterministically uses freed esd_usb_net_priv in the same teardown path; the attacker fully controls when unbind occurs, with no attacker-uncontrollable race required.\nPR:L - A basic local account with write access to the USB device node (plugdev/uaccess or USB passthrough) can issue USBDEVFS_DISCONNECT; that path has no CAP_SYS_ADMIN check, so init-namespace root is not required.\nUI:N - The attacker issues disconnect/unbind against an already-bound esd CAN-USB interface (or their own matching VID/PID device) without any separate victim action.\nS:U - The freed netdev-private object and subsequent URB teardown run entirely within the host kernel security authority; this is not a VM, IOMMU, or sandbox boundary escape.\nC:H - Use-after-free of struct esd_usb_net_priv (embedded in the freed candev) lets a reclaimed object supply attacker-controlled pointer-rich state read through usb_kill_anchored_urbs() and related teardown, enabling kernel disclosure.\nI:H - unlink_all_urbs() writes through the freed priv (usb_kill_anchored_urbs on tx_submitted, atomic_set of active_tx_jobs, and tx_contexts[] resets), giving a heap UAF write primitive suitable for control-flow hijack.\nA:H - Dereferencing the freed per-netdev private data during disconnect reliably causes kernel oops/panic, and the attacker can repeat unbind/rebind to re-trigger the crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:22.712Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d"
},
{
"url": "https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e"
},
{
"url": "https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9"
},
{
"url": "https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c"
},
{
"url": "https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e"
},
{
"url": "https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264"
}
],
"title": "can: esd_usb: kill anchored URBs before freeing netdevs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64585",
"datePublished": "2026-08-06T07:06:26.556Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-08T15:13:22.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64584 (GCVE-0-2026-64584)
Vulnerability from nvd – Published: 2026-08-06 07:06 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
The f_midi driver embeds a work item (midi->work) whose handler,
f_midi_in_work(), dereferences the enclosing struct f_midi through
container_of(). This work is armed from two sites: f_midi_complete(),
on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA
rawmidi output-stream start.
Neither f_midi_disable() nor f_midi_unbind() cancels midi->work.
f_midi_disable() only disables the endpoints and drains the in_req_fifo;
it does not synchronize the work item, and the sound card is released
asynchronously to the final free of the midi object.
The midi object is reference-counted (midi->free_ref) and is freed in
f_midi_free() only once both the usb_function reference and the rawmidi
private_data reference have been dropped. In f_midi_unbind(),
f_midi_disable() runs before the sound card is released, so while the
USB endpoints are already disabled the rawmidi device is still usable by
an open substream. A concurrent userspace write on such a substream can
reach f_midi_in_trigger() and queue midi->work again after
f_midi_disable() has returned. A work item armed this way may still be
pending when the last reference drops and f_midi_free() proceeds to
kfree(midi), letting f_midi_in_work() dereference the struct after it
has been freed, a use-after-free.
For this reason cancelling midi->work in f_midi_disable() would not be
sufficient: the ALSA trigger path can rearm the work after disable()
returns. Cancelling at the refcount-zero free site is the boundary
after which neither arming source can survive, because by then both
references that keep the midi object alive have been dropped: the USB
endpoints are already disabled and the rawmidi device has been released.
Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero
block of f_midi_free(), before the embedded work_struct is freed along
with the rest of the structure. opts->lock is a sleeping mutex, so
calling cancel_work_sync() under it is permitted, and the handler takes
midi->transmit_lock rather than opts->lock, so no self-deadlock can
occur while it waits for a running instance of the work to finish.
This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9
(git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 87bc316dd6fc90072297c635e10b9aa6075ecda1 (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < f45089eaad0a083d71d84ff175741d7e157d9b69 (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < ac9a51d910bb7465c554c45320cb6c09f3d0b49d (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 5650c18d93a1db7e27cb5a40b394747eb4686d5b (git) Affected: 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d (git) Affected: 3635523e9b96213969693c320302d536774d8e9b (git) Affected: 5.4.291 , < 5.5 (semver) Affected: 5.10.235 , < 5.11 (semver) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "87bc316dd6fc90072297c635e10b9aa6075ecda1",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "f45089eaad0a083d71d84ff175741d7e157d9b69",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "ac9a51d910bb7465c554c45320cb6c09f3d0b49d",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "5650c18d93a1db7e27cb5a40b394747eb4686d5b",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"status": "affected",
"version": "89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d",
"versionType": "git"
},
{
"status": "affected",
"version": "3635523e9b96213969693c320302d536774d8e9b",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.291",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.235",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.291",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.235",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi-\u003ework) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of(). This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi-\u003efree_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped. In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream. A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi-\u003ework again after\nf_midi_disable() has returned. A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi-\u003ework in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns. Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure. opts-\u003elock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached by local configfs UDC clear or function unlink (unregister_gadget \u2192 f_midi_unbind/disable) plus ALSA rawmidi write/close on /dev/snd/midi*; no USB host traffic or cable access is required, and dummy_hcd suffices, matching other gadget teardown UAFs scored AV:L.\nAC:L - The attacker controls both sides of the race: opening/writing the rawmidi substream to queue midi-\u003ework via f_midi_in_trigger after disable, and forcing unbind plus dropping the last free_ref via configfs unlink/close, so the window is freely repeatable.\nPR:L - Exploitation needs access to the gadget configfs tree and/or the ALSA MIDI node; both are routinely delegated to non-root system/audio accounts on Android and embedded MIDI gadgets, with no capability check on the rawmidi write or UDC store path itself.\nUI:N - The attacker performs the full sequence\u2014configfs unbind/unlink, rawmidi write to rearm work, and close to free the midi object\u2014without any action by another user or administrator.\nS:U - The use-after-free corrupts kernel heap within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - f_midi_in_work() container_of()s the freed embedded work_struct and then reads midi-\u003ein_ep, fifo, and port/substream fields; reclaiming the freed f_midi slab yields a classic UAF read/disclosure primitive.\nI:H - Post-free f_midi_transmit()/f_midi_drop_out_substreams() write through the reclaimed object (port state, kfifo, snd_rawmidi_drop_output), giving a heap write-after-free primitive suitable for control-flow hijack.\nA:H - Dereferencing the freed f_midi from system_highpri_wq reliably produces KASAN reports, oops, or kernel panic even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:21.611Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9"
},
{
"url": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1"
},
{
"url": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69"
},
{
"url": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d"
},
{
"url": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b"
}
],
"title": "usb: gadget: f_midi: cancel pending IN work before freeing the midi object",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64584",
"datePublished": "2026-08-06T07:06:25.953Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-08T15:13:21.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64583 (GCVE-0-2026-64583)
Vulnerability from nvd – Published: 2026-08-06 07:06 – Updated: 2026-08-08 15:13
VLAI
EPSS
VEX
Title
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
The Broadcom BDC UDC driver registers its IRQ handler with
devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm
only after bdc_remove() returns. devm releases resources in reverse
LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->
bdc_mem_free() manually before returning: bdc_udc_exit() tears down
individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->
bdc_mem_free() frees and NULLs the DMA-coherent status-report ring
(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while
the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)
remains deliverable in the window up to the post-remove devm
free_irq().
On receipt of a shared interrupt in that window, bdc_udc_interrupt()
dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)
and dispatches sr_handler callbacks that index into bdc_ep_array,
causing a NULL-deref or use-after-free.
The same window affects the delayed_work bdc->func_wake_notify, which is
armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change()
-> schedule_delayed_work() and may self-rearm from its own callback
bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a
queued work item that fires after bdc_remove() returns and the bdc
structure is devm-freed dereferences freed memory.
Replace devm_request_irq() with request_irq() and add an explicit
free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before
free_irq() to stop the device from asserting interrupts, then
free_irq() drains any in-flight handler, then cancel_delayed_work_sync()
drains the func_wake_notify delayed work. This ordering ensures the
IRQ handler and delayed work cannot interfere with the subsequent
endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the
matching free_irq() into the bdc_udc_init() error path so the IRQ is
released on probe failure, and route the bdc_init_ep() failure through
err0 instead of returning directly.
This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
efed421a94e62a7ddbc76acba4312b70e4be958f , < 1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8
(git)
Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < f6fc21ec7ccd83726ba766d73d0b8cc03e726475 (git) Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < dcf3e2f164435b5844706cb8eefef29ebee0eedb (git) Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < d4964a74717107697999f48bcb4e80a9c0679a27 (git) Affected: efed421a94e62a7ddbc76acba4312b70e4be958f , < 0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb (git) |
|
| Linux | Linux |
Affected:
3.19
Unaffected: 0 , < 3.19 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/bdc/bdc_core.c",
"drivers/usb/gadget/udc/bdc/bdc_udc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8",
"status": "affected",
"version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
"versionType": "git"
},
{
"lessThan": "f6fc21ec7ccd83726ba766d73d0b8cc03e726475",
"status": "affected",
"version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
"versionType": "git"
},
{
"lessThan": "dcf3e2f164435b5844706cb8eefef29ebee0eedb",
"status": "affected",
"version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
"versionType": "git"
},
{
"lessThan": "d4964a74717107697999f48bcb4e80a9c0679a27",
"status": "affected",
"version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
"versionType": "git"
},
{
"lessThan": "0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb",
"status": "affected",
"version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/bdc/bdc_core.c",
"drivers/usb/gadget/udc/bdc/bdc_udc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n\nThe Broadcom BDC UDC driver registers its IRQ handler with\ndevm_request_irq() in bdc_udc_init(), so the IRQ is released by devm\nonly after bdc_remove() returns. devm releases resources in reverse\nLIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -\u003e\nbdc_mem_free() manually before returning: bdc_udc_exit() tears down\nindividual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -\u003e\nbdc_mem_free() frees and NULLs the DMA-coherent status-report ring\n(bdc-\u003esrr.sr_bds) and kfree()s bdc-\u003ebdc_ep_array. Both happen while\nthe IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)\nremains deliverable in the window up to the post-remove devm\nfree_irq().\n\nOn receipt of a shared interrupt in that window, bdc_udc_interrupt()\ndereferences bdc-\u003esrr.sr_bds[bdc-\u003esrr.dqp_index] (NULL or freed DMA)\nand dispatches sr_handler callbacks that index into bdc_ep_array,\ncausing a NULL-deref or use-after-free.\n\nThe same window affects the delayed_work bdc-\u003efunc_wake_notify, which is\narmed from the IRQ handler via bdc_sr_uspc() -\u003e handle_link_state_change()\n-\u003e schedule_delayed_work() and may self-rearm from its own callback\nbdc_func_wake_timer(). No cancel exists anywhere in the driver, so a\nqueued work item that fires after bdc_remove() returns and the bdc\nstructure is devm-freed dereferences freed memory.\n\nReplace devm_request_irq() with request_irq() and add an explicit\nfree_irq(bdc-\u003eirq, bdc) in bdc_remove(). Clear BDC_GIE before\nfree_irq() to stop the device from asserting interrupts, then\nfree_irq() drains any in-flight handler, then cancel_delayed_work_sync()\ndrains the func_wake_notify delayed work. This ordering ensures the\nIRQ handler and delayed work cannot interfere with the subsequent\nendpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the\nmatching free_irq() into the bdc_udc_init() error path so the IRQ is\nreleased on probe failure, and route the bdc_init_ep() failure through\nerr0 instead of returning directly.\n\nThis issue was found by an in-house static analysis tool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable window opens on local BDC platform-driver teardown (sysfs unbind/rmmod \u2192 bdc_remove), not on parsing USB host packets; that matches other USB gadget/UDC teardown UAFs scored AV:L and is higher severity than Physical.\nAC:L - The attacker controls remove/bind retries; a pending func_wake_notify (never cancelled before the fix) runs deterministically on the post-remove freed bdc, and IRQF_SHARED plus USB activity can also hit the IRQ window during teardown.\nPR:L - Highest reasonable exposure is a local account managing the gadget/UDC on Android or Broadcom STB systems where platform unbind is delegated beyond init-namespace root; uncertain Low vs High, so Low per the overestimate rule.\nUI:N - The attacker performs driver remove and any prior link-state activity that arms func_wake_notify themselves; no separate victim mount, open, or other interaction is required.\nS:U - NULL-deref/use-after-free of sr_bds, bdc_ep_array, and the delayed-work bdc object stays inside the host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of the DMA status-report ring, endpoint array, and the bdc object via IRQ/work handlers allows reclaim/spray and disclosure of kernel memory, which per UAF guidance is High.\nI:H - The same UAF paths write through freed endpoint/status structures and run delayed work on a freed bdc, enabling heap corruption and control-flow hijack suitable for privilege escalation.\nA:H - Dereferencing NULL/freed sr_bds in hard-IRQ context or executing bdc_func_wake_timer on a post-remove freed bdc causes kernel oops/panic, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T15:13:20.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8"
},
{
"url": "https://git.kernel.org/stable/c/f6fc21ec7ccd83726ba766d73d0b8cc03e726475"
},
{
"url": "https://git.kernel.org/stable/c/dcf3e2f164435b5844706cb8eefef29ebee0eedb"
},
{
"url": "https://git.kernel.org/stable/c/d4964a74717107697999f48bcb4e80a9c0679a27"
},
{
"url": "https://git.kernel.org/stable/c/0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb"
}
],
"title": "usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64583",
"datePublished": "2026-08-06T07:06:25.335Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-08T15:13:20.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68082 (GCVE-0-2026-68082)
Vulnerability from cvelistv5 – Published: 2026-08-08 09:17 – Updated: 2026-08-08 09:17
VLAI
EPSS
VEX
Title
libceph: fix two unsafe bare decodes in decode_lockers()
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix two unsafe bare decodes in decode_lockers()
decode_lockers() in cls_lock_client.c contains two bare decode operations
that allow a malicious or compromised OSD to trigger slab-out-of-bounds
reads:
1. ceph_decode_32(p) at the num_lockers field has no preceding bounds
check. ceph_start_decoding() accepts struct_len=0 as valid -- the
internal ceph_decode_need(p, end, 0, bad) always passes -- so when an
OSD sends struct_len=0, ceph_start_decoding() returns success with
p == end. The immediately following bare ceph_decode_32(p) then reads
4 bytes past the validated buffer boundary. The garbage value is
passed directly to kzalloc_objs() as the locker count.
The sibling function decode_watchers() in osd_client.c already uses
ceph_decode_32_safe() after its own ceph_start_decoding() call.
decode_lockers() was the only site using the bare variant.
2. ceph_decode_8(p) after the decode_locker() loop has no preceding
bounds check. If an OSD crafts num_lockers such that the loop
advances p exactly to end, the subsequent bare ceph_decode_8(p) reads
one byte past the validated buffer boundary. The result is passed
directly into *type, which is used as a lock type discriminator by
callers, giving an OSD-controlled one-byte OOB read with direct
influence over the lock type field.
Fix both by replacing bare operations with their safe variants:
ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers,
err_inval)
ceph_decode_8(p) -> ceph_decode_8_safe(p, end, *type,
err_free_lockers)
The goto targets differ intentionally:
err_inval: is a new label returning -EINVAL directly. It is used for
the pre-allocation failure path where *lockers is not yet allocated
and must not be passed to ceph_free_lockers().
err_free_lockers: is the existing label. It is used for the
post-allocation failure path where *lockers is allocated and must
be freed.
ret is set to -EINVAL before ceph_decode_8_safe() so that
err_free_lockers returns the correct error code on bounds violation.
Without this, err_free_lockers would return a stale ret value (0 from
the successful decode_locker() loop), silently swallowing the error.
-EINVAL is correct for both failure paths. The data received from the
OSD is structurally malformed. -ENOMEM would misrepresent the failure
class to callers and to stable@ backporters triaging error paths.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
deployment can trigger this against any kernel client that issues the
lock.get_info class method (e.g. during RBD exclusive lock acquisition).
[ idryomov: trim changelog, formatting ]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d4ed4a530562881cc5225050e42d96034f405aae , < a54be593d0b749161b08a1e56189b2cb9114267a
(git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < a109a556115271ca7896dcda7b4b7e45e156c227 (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a54be593d0b749161b08a1e56189b2cb9114267a",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "a109a556115271ca7896dcda7b4b7e45e156c227",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix two unsafe bare decodes in decode_lockers()\n\ndecode_lockers() in cls_lock_client.c contains two bare decode operations\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds\nreads:\n\n1. ceph_decode_32(p) at the num_lockers field has no preceding bounds\n check. ceph_start_decoding() accepts struct_len=0 as valid -- the\n internal ceph_decode_need(p, end, 0, bad) always passes -- so when an\n OSD sends struct_len=0, ceph_start_decoding() returns success with\n p == end. The immediately following bare ceph_decode_32(p) then reads\n 4 bytes past the validated buffer boundary. The garbage value is\n passed directly to kzalloc_objs() as the locker count.\n\n The sibling function decode_watchers() in osd_client.c already uses\n ceph_decode_32_safe() after its own ceph_start_decoding() call.\n decode_lockers() was the only site using the bare variant.\n\n2. ceph_decode_8(p) after the decode_locker() loop has no preceding\n bounds check. If an OSD crafts num_lockers such that the loop\n advances p exactly to end, the subsequent bare ceph_decode_8(p) reads\n one byte past the validated buffer boundary. The result is passed\n directly into *type, which is used as a lock type discriminator by\n callers, giving an OSD-controlled one-byte OOB read with direct\n influence over the lock type field.\n\nFix both by replacing bare operations with their safe variants:\n ceph_decode_32(p) -\u003e ceph_decode_32_safe(p, end, *num_lockers,\n err_inval)\n ceph_decode_8(p) -\u003e ceph_decode_8_safe(p, end, *type,\n err_free_lockers)\n\nThe goto targets differ intentionally:\n err_inval: is a new label returning -EINVAL directly. It is used for\n the pre-allocation failure path where *lockers is not yet allocated\n and must not be passed to ceph_free_lockers().\n\n err_free_lockers: is the existing label. It is used for the\n post-allocation failure path where *lockers is allocated and must\n be freed.\n\nret is set to -EINVAL before ceph_decode_8_safe() so that\nerr_free_lockers returns the correct error code on bounds violation.\nWithout this, err_free_lockers would return a stale ret value (0 from\nthe successful decode_locker() loop), silently swallowing the error.\n\n-EINVAL is correct for both failure paths. The data received from the\nOSD is structurally malformed. -ENOMEM would misrepresent the failure\nclass to callers and to stable@ backporters triaging error paths.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).\n\n[ idryomov: trim changelog, formatting ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T09:17:45.394Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a54be593d0b749161b08a1e56189b2cb9114267a"
},
{
"url": "https://git.kernel.org/stable/c/a109a556115271ca7896dcda7b4b7e45e156c227"
}
],
"title": "libceph: fix two unsafe bare decodes in decode_lockers()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68082",
"datePublished": "2026-08-08T09:17:45.394Z",
"dateReserved": "2026-07-30T09:28:09.367Z",
"dateUpdated": "2026-08-08T09:17:45.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68081 (GCVE-0-2026-68081)
Vulnerability from cvelistv5 – Published: 2026-08-08 09:17 – Updated: 2026-08-08 09:17
VLAI
EPSS
VEX
Title
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid
guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path
doesn't use nested_vmx_vmexit() as that API is intended to be used if and
only if L2 is active, and the open coded equivalent neglects to put the
vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages
(and/or mappings) if L1 retries VMLAUNCH/VMRESUME.
Note, the !from_vmenter scenario doesn't suffer the same problem, as
vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is
active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry
getting vmcs12 pages.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
96c66e87deeeb3cc78a3b82a1de8e365eec206c1 , < 7996013b85687034d2e820cef94d6404192e3a3d
(git)
Affected: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 , < 2c87a087c20632d68920272173b5d7c47f9bcf70 (git) Affected: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 , < 2f2312c422fd2695da772cecb30c69994b795964 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7996013b85687034d2e820cef94d6404192e3a3d",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "2c87a087c20632d68920272173b5d7c47f9bcf70",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "2f2312c422fd2695da772cecb30c69994b795964",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state\n\nPut all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid\nguest while emulating VMLAUNCH or VMRESUME. The invalid guest state path\ndoesn\u0027t use nested_vmx_vmexit() as that API is intended to be used if and\nonly if L2 is active, and the open coded equivalent neglects to put the\nvmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages\n(and/or mappings) if L1 retries VMLAUNCH/VMRESUME.\n\nNote, the !from_vmenter scenario doesn\u0027t suffer the same problem, as\nvmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is\nactive, i.e. if a \"full\" VM-Exit is guaranteed before KVM will retry\ngetting vmcs12 pages."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T09:17:44.795Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7996013b85687034d2e820cef94d6404192e3a3d"
},
{
"url": "https://git.kernel.org/stable/c/2c87a087c20632d68920272173b5d7c47f9bcf70"
},
{
"url": "https://git.kernel.org/stable/c/2f2312c422fd2695da772cecb30c69994b795964"
}
],
"title": "KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68081",
"datePublished": "2026-08-08T09:17:44.795Z",
"dateReserved": "2026-07-30T09:28:09.367Z",
"dateUpdated": "2026-08-08T09:17:44.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68480 (GCVE-0-2026-68480)
Vulnerability from cvelistv5 – Published: 2026-08-06 17:36 – Updated: 2026-08-09 03:38
VLAI
EPSS
VEX
Title
x86/bugs: Make Safe-RET robust against interrupt injection
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Make Safe-RET robust against interrupt injection
An attacker injecting interrupts while the Safe-RET mitigation executes
on machines affected by SRSO can neutralize the safe return sequence,
potentially leading to data leakage through speculative execution.
Fixup register state as if the Safe-RET sequence executed successfully
by "emulating" it, in a manner of speaking, and avoid executing a RET
instruction after returning from the interrupt.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dfefa3c51370f84acb643cddf98bb42c885d0483
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 52db77a13be224e09eb4ba6b4252ae8ab9085c2c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d0208e08d64d99383e09852a76cc3038c5a4c3ab (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e262f28a69ae9e0791248f93b0173c1d1f3e1d5d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bfe7f9993467ba431b2731437949ac1e2634e771 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 61649a2d61cb0dbc673f0f232f0f0c298bf50442 (git) Affected: 0 , < 5.10.264 (semver) Affected: 0 , < 5.15.215 (semver) Affected: 0 , < 6.1.182 (semver) Affected: 0 , < 6.6.150 (semver) Affected: 0 , < 6.12.102 (semver) Affected: 0 , < 6.18.43 (semver) Affected: 0 , < 7.1.7 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.264 , ≤ 5.10.*
(semver)
Unaffected: 5.15.215 , ≤ 5.15.* (semver) Unaffected: 6.1.182 , ≤ 6.1.* (semver) Unaffected: 6.6.150 , ≤ 6.6.* (semver) Unaffected: 6.12.102 , ≤ 6.12.* (semver) Unaffected: 6.18.43 , ≤ 6.18.* (semver) Unaffected: 7.1.7 , ≤ 7.1.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_64.S",
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c",
"arch/x86/lib/retpoline.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dfefa3c51370f84acb643cddf98bb42c885d0483",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "52db77a13be224e09eb4ba6b4252ae8ab9085c2c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d0208e08d64d99383e09852a76cc3038c5a4c3ab",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e262f28a69ae9e0791248f93b0173c1d1f3e1d5d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bfe7f9993467ba431b2731437949ac1e2634e771",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "61649a2d61cb0dbc673f0f232f0f0c298bf50442",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.264",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.215",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.182",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.150",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.102",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.43",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_64.S",
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c",
"arch/x86/lib/retpoline.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.264",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.182",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.102",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.43",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.264",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.215",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.182",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.150",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.102",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Make Safe-RET robust against interrupt injection\n\nAn attacker injecting interrupts while the Safe-RET mitigation executes\non machines affected by SRSO can neutralize the safe return sequence,\npotentially leading to data leakage through speculative execution.\n\nFixup register state as if the Safe-RET sequence executed successfully\nby \"emulating\" it, in a manner of speaking, and avoid executing a RET\ninstruction after returning from the interrupt."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T03:38:14.420Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"
},
{
"url": "https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"
},
{
"url": "https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab"
},
{
"url": "https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096"
},
{
"url": "https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d"
},
{
"url": "https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771"
},
{
"url": "https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442"
},
{
"url": "https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf"
}
],
"title": "x86/bugs: Make Safe-RET robust against interrupt injection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68480",
"datePublished": "2026-08-06T17:36:43.654Z",
"dateReserved": "2026-07-30T09:28:09.397Z",
"dateUpdated": "2026-08-09T03:38:14.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64604 (GCVE-0-2026-64604)
Vulnerability from cvelistv5 – Published: 2026-08-06 07:13 – Updated: 2026-08-06 17:37
VLAI
EPSS
VEX
Title
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.
------------[ cut here ]------------
debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
Modules linked in:
CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
Call Trace:
<TASK>
apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
No functional change intended.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a7c0b07d570848e50fce4d31ac01313484d6b844 , < c7cd3605244c924249dea32632e1bc3e89bda543
(git)
Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 9a21f1defd96c6301c5fb462a78eb51b191bd2dd (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 570af5db081b87374594a00711ac5760d2ea6844 (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4 (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 3dcfb04dd43b16fa1240fc6487fff578ad57264c (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < db8407b9fd06d857a4a5e8bcff1d086d13007711 (git) Affected: a7c0b07d570848e50fce4d31ac01313484d6b844 , < 7ef78d71ca713d8c00f7c34ddcf276c808143f77 (git) |
|
| Linux | Linux |
Affected:
3.18
Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/vmx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7cd3605244c924249dea32632e1bc3e89bda543",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "9a21f1defd96c6301c5fb462a78eb51b191bd2dd",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "570af5db081b87374594a00711ac5760d2ea6844",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "3dcfb04dd43b16fa1240fc6487fff578ad57264c",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "db8407b9fd06d857a4a5e8bcff1d086d13007711",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
},
{
"lessThan": "7ef78d71ca713d8c00f7c34ddcf276c808143f77",
"status": "affected",
"version": "a7c0b07d570848e50fce4d31ac01313484d6b844",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/vmx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode\n\nWhen updating CR8 intercepts, get vmcs12 if and only if the vCPU is in\nguest mode so that a future change can have update CR8 intercepts during\nvCPU creation, without running afoul of get_vmcs12()\u0027s lockdep assertion.\n\n ------------[ cut here ]------------\n debug_locks \u0026\u0026 !(lock_is_held(\u0026(\u0026vcpu-\u003emutex)-\u003edep_map) || !refcount_read(\u0026vcpu-\u003ekvm-\u003eusers_count))\n WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879\n WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879\n Modules linked in:\n CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]\n RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879\n Call Trace:\n \u003cTASK\u003e\n apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]\n kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023\n kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986\n kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847\n kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201\n kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nNo functional change intended."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:37:50.817Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543"
},
{
"url": "https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd"
},
{
"url": "https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844"
},
{
"url": "https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a"
},
{
"url": "https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4"
},
{
"url": "https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c"
},
{
"url": "https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711"
},
{
"url": "https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77"
}
],
"title": "KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64604",
"datePublished": "2026-08-06T07:13:55.718Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T17:37:50.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64603 (GCVE-0-2026-64603)
Vulnerability from cvelistv5 – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
platform/x86: intel-hid: Protect ACPI notify handler against recursion
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: intel-hid: Protect ACPI notify handler against recursion
Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on
all CPUs") ACPI notify handlers like the intel-hid notify_handler() may
run on multiple CPU cores racing with themselves.
On convertibles and detachables (matched by DMI chassis-type 31 and 32 in
dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered
lazily from notify_handler() on the first tablet-mode event, via
intel_hid_switches_setup(). When two such events race on different CPUs
both can pass the !priv->switches check and register the priv->switches
input device twice, resulting in a duplicate sysfs entry and a subsequent
NULL pointer dereference.
This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86:
intel-vbtn: Protect ACPI notify handler against recursion") for the
sibling intel-vbtn driver.
Protect intel-hid notify_handler() from racing with itself with a mutex
to fix this.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2ffcda1629012a2c1a3706432bc45fdc899a584 , < a6402808e552e44e9c26a9fe8395ac11703d5800
(git)
Affected: e2ffcda1629012a2c1a3706432bc45fdc899a584 , < 86df6499dfd232fbc1c82c0d6eb9322ca67b8cd0 (git) Affected: e2ffcda1629012a2c1a3706432bc45fdc899a584 , < eace3b3e729d5ba11794d69acfafb58a7950217c (git) Affected: e2ffcda1629012a2c1a3706432bc45fdc899a584 , < c085d82613d5618814b84406c8b2d64f1bc305e7 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/intel/hid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6402808e552e44e9c26a9fe8395ac11703d5800",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
},
{
"lessThan": "86df6499dfd232fbc1c82c0d6eb9322ca67b8cd0",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
},
{
"lessThan": "eace3b3e729d5ba11794d69acfafb58a7950217c",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
},
{
"lessThan": "c085d82613d5618814b84406c8b2d64f1bc305e7",
"status": "affected",
"version": "e2ffcda1629012a2c1a3706432bc45fdc899a584",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/intel/hid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: intel-hid: Protect ACPI notify handler against recursion\n\nSince commit e2ffcda16290 (\"ACPI: OSL: Allow Notify () handlers to run on\nall CPUs\") ACPI notify handlers like the intel-hid notify_handler() may\nrun on multiple CPU cores racing with themselves.\n\nOn convertibles and detachables (matched by DMI chassis-type 31 and 32 in\ndmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered\nlazily from notify_handler() on the first tablet-mode event, via\nintel_hid_switches_setup(). When two such events race on different CPUs\nboth can pass the !priv-\u003eswitches check and register the priv-\u003eswitches\ninput device twice, resulting in a duplicate sysfs entry and a subsequent\nNULL pointer dereference.\n\nThis is the same class of bug fixed by commit e075c3b13a0a (\"platform/x86:\nintel-vbtn: Protect ACPI notify handler against recursion\") for the\nsibling intel-vbtn driver.\n\nProtect intel-hid notify_handler() from racing with itself with a mutex\nto fix this."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:55.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6402808e552e44e9c26a9fe8395ac11703d5800"
},
{
"url": "https://git.kernel.org/stable/c/86df6499dfd232fbc1c82c0d6eb9322ca67b8cd0"
},
{
"url": "https://git.kernel.org/stable/c/eace3b3e729d5ba11794d69acfafb58a7950217c"
},
{
"url": "https://git.kernel.org/stable/c/c085d82613d5618814b84406c8b2d64f1bc305e7"
}
],
"title": "platform/x86: intel-hid: Protect ACPI notify handler against recursion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64603",
"datePublished": "2026-08-06T07:13:55.114Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:55.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64602 (GCVE-0-2026-64602)
Vulnerability from cvelistv5 – Published: 2026-08-06 07:13 – Updated: 2026-08-06 07:13
VLAI
EPSS
VEX
Title
iio: adc: spear: Initialize completion before requesting IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: spear: Initialize completion before requesting IRQ
In the report from Jaeyoung Chung:
"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in spear_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
spear_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < aea8ae6c4d3ed58d9223360f758df6bd8b90c608
(git)
Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < 67a49ab41320b3f721ce4be7447754ff040acbd5 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < a50757398794aaa25f908b96c6733e045466cba4 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < f3f90bc7b38ba3ff14f131cea0f8eb77624787a8 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < 37077d8271b1f24894fbc21bca1c4cd337525d31 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < bbfebae473ac2c8a194523b29ccb9b45f02f134c (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < eb5b07c9d0ec1a9d4b6871b14793c19967d79dc4 (git) Affected: b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed , < 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 (git) |
|
| Linux | Linux |
Affected:
3.16
Unaffected: 0 , < 3.16 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/spear_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aea8ae6c4d3ed58d9223360f758df6bd8b90c608",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "67a49ab41320b3f721ce4be7447754ff040acbd5",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "a50757398794aaa25f908b96c6733e045466cba4",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "f3f90bc7b38ba3ff14f131cea0f8eb77624787a8",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "37077d8271b1f24894fbc21bca1c4cd337525d31",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "bbfebae473ac2c8a194523b29ccb9b45f02f134c",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "eb5b07c9d0ec1a9d4b6871b14793c19967d79dc4",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
},
{
"lessThan": "3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0",
"status": "affected",
"version": "b586e5d9eee038b8ee6f846cdb6cf2fcbcb2f4ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/spear_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: spear: Initialize completion before requesting IRQ\n\nIn the report from Jaeyoung Chung:\n\n\"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its\ninterrupt handler with devm_request_irq() before it initializes\nst-\u003ecompletion with init_completion(). If an interrupt arrives after\ndevm_request_irq() and before init_completion(), the handler calls\ncomplete() on an uninitialized completion, causing a kernel panic.\n\nThe probe path, in spear_adc_probe():\n\n iodev = devm_iio_device_alloc(\u0026pdev-\u003edev, sizeof(*st)); /* st kzalloc-zeroed */\n ...\n retval = devm_request_irq(\u0026pdev-\u003edev, irq, spear_adc_isr, 0,\n LPC32XXAD_NAME, st); /* register handler */\n ...\n init_completion(\u0026st-\u003ecompletion); /* initialize completion */\n\nspear_adc_isr() calls complete():\n\n complete(\u0026st-\u003ecompletion);\n\nIf the device raises an interrupt before init_completion() runs,\ncomplete() acquires the uninitialized wait.lock and walks the zeroed\ntask_list in swake_up_locked(). The zeroed task_list makes list_empty()\nreturn false, so swake_up_locked() dereferences a NULL list entry,\ntriggering a KASAN wild-memory-access.\"\n\nFix the chance of a spurious IRQ causing an uninitialized pointer\ndereference by moving init_completion() above devm_request_irq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:13:54.519Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aea8ae6c4d3ed58d9223360f758df6bd8b90c608"
},
{
"url": "https://git.kernel.org/stable/c/67a49ab41320b3f721ce4be7447754ff040acbd5"
},
{
"url": "https://git.kernel.org/stable/c/a50757398794aaa25f908b96c6733e045466cba4"
},
{
"url": "https://git.kernel.org/stable/c/f3f90bc7b38ba3ff14f131cea0f8eb77624787a8"
},
{
"url": "https://git.kernel.org/stable/c/37077d8271b1f24894fbc21bca1c4cd337525d31"
},
{
"url": "https://git.kernel.org/stable/c/bbfebae473ac2c8a194523b29ccb9b45f02f134c"
},
{
"url": "https://git.kernel.org/stable/c/eb5b07c9d0ec1a9d4b6871b14793c19967d79dc4"
},
{
"url": "https://git.kernel.org/stable/c/3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0"
}
],
"title": "iio: adc: spear: Initialize completion before requesting IRQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64602",
"datePublished": "2026-08-06T07:13:54.519Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-06T07:13:54.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}