{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49974",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:33:23.238318Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:45.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:23:54.801Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/netns.h",
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e52ff544e0bfa09ee339fd7b0937ee3c080c24e",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "7ea9260874b779637aff6d24c344b8ef4ac862a0",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "ae267989b7b7933dfedcd26468d0a88fc3a9da9e",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "b4e21431a0db4854b5023cd5af001be557e6c3db",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "6a488ad7745b8f64625c6d3a24ce7e448e83f11b",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            },
            {
              "lessThan": "aadc3bbea163b6caaaebfdd2b6c4667fbc726752",
              "status": "affected",
              "version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/netns.h",
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.119",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.63",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Limit the number of concurrent async COPY operations\n\nNothing appears to limit the number of concurrent async COPY\noperations that clients can start. In addition, AFAICT each async\nCOPY can copy an unlimited number of 4MB chunks, so can run for a\nlong time. Thus IMO async COPY can become a DoS vector.\n\nAdd a restriction mechanism that bounds the number of concurrent\nbackground COPY operations. Start simple and try to be fair -- this\npatch implements a per-namespace limit.\n\nAn async COPY request that occurs while this limit is exceeded gets\nNFS4ERR_DELAY. The requesting client can choose to send the request\nagain after a delay or fall back to a traditional read/write style\ncopy.\n\nIf there is need to make the mechanism more sophisticated, we can\nvisit that in future patches."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:43:08.284Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e52ff544e0bfa09ee339fd7b0937ee3c080c24e"
        },
        {
          "url": "https://git.kernel.org/stable/c/43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ea9260874b779637aff6d24c344b8ef4ac862a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae267989b7b7933dfedcd26468d0a88fc3a9da9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4e21431a0db4854b5023cd5af001be557e6c3db"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a488ad7745b8f64625c6d3a24ce7e448e83f11b"
        },
        {
          "url": "https://git.kernel.org/stable/c/aadc3bbea163b6caaaebfdd2b6c4667fbc726752"
        }
      ],
      "title": "NFSD: Limit the number of concurrent async COPY operations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49974",
    "datePublished": "2024-10-21T18:02:22.392Z",
    "dateReserved": "2024-10-21T12:17:06.052Z",
    "dateUpdated": "2026-05-11T20:43:08.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:46:55.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c",
            "net/sched/sch_choke.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44782565e1e6174c94bddfa72ac7267cd09c1648",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "5e473f462a16f1a34e49ea4289a667d2e4f35b52",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "33db36b3c53d0fda2699ea39ba72bee4de8336e8",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "489422e2befff88a1de52b2acebe7b333bded025",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "97e13434b5da8e91bdf965352fad2141d13d72d3",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "e3e54ad9eff8bdaa70f897e5342e34b76109497f",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "5eb7de8cd58e73851cd37ff8d0666517d9926948",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c",
            "net/sched/sch_choke.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.289",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.233",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.289",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.233",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.176",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.122",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.68",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.7",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix ordering of qlen adjustment\n\nChanges to sch-\u003eq.qlen around qdisc_tree_reduce_backlog() need to happen\n_before_ a call to said function because otherwise it may fail to notify\nparent qdiscs when the child is about to become empty."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable qdisc hierarchy (cake/choke leaf under a classful parent such as DRR/QFQ/HFSC) is built through rtnetlink RTM_NEWQDISC/RTM_NEWTCLASS and triggered by locally injected traffic on a local device, matching the tc/netlink qdisc local vector.\nAC:L - The attacker fully controls every precondition \u2014 the qdisc topology, the cake memlimit / choke limit that forces the drop, and the packet injection \u2014 making the miscounted qlen and the resulting stale active class deterministic with no race to win.\nPR:L - tc configuration requires only CAP_NET_ADMIN over the target netns, checked via namespace-relative netlink_net_capable(); an unprivileged user obtains it with `unshare -Urn` and uses the always-present `lo` device.\nUI:N - The attacker performs all steps \u2014 creating the qdisc tree, sending packets, and deleting the class \u2014 with no action by any other user.\nS:U - The corruption and its consequences remain within the kernel\u0027s own security authority; this is standard local kernel privilege escalation with no crossing into a hypervisor or IOMMU boundary.\nC:H - The missed qlen_notify() leaves a freed class linked in the parent\u0027s active list/rbtree, and the resulting use-after-free lets the attacker reclaim the slab object and read back attacker-shaped kernel memory, yielding arbitrary kernel read.\nI:H - The same use-after-free provides both a hijackable indirect call through cl-\u003eqdisc-\u003eops-\u003epeek and unlink-style writes via list_del(\u0026cl-\u003ealist)/rb_erase(\u0026cl-\u003eel_node), giving control-flow hijack and arbitrary write.\nA:H - The stale class causes an immediate use-after-free oops, and even absent full exploitation the permanently non-dequeuing qdisc wedges all transmission on the device, a complete availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:12.310Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44782565e1e6174c94bddfa72ac7267cd09c1648"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e473f462a16f1a34e49ea4289a667d2e4f35b52"
        },
        {
          "url": "https://git.kernel.org/stable/c/33db36b3c53d0fda2699ea39ba72bee4de8336e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/489422e2befff88a1de52b2acebe7b333bded025"
        },
        {
          "url": "https://git.kernel.org/stable/c/97e13434b5da8e91bdf965352fad2141d13d72d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3e54ad9eff8bdaa70f897e5342e34b76109497f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5eb7de8cd58e73851cd37ff8d0666517d9926948"
        }
      ],
      "title": "net: sched: fix ordering of qlen adjustment",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53164",
    "datePublished": "2024-12-27T13:38:43.407Z",
    "dateReserved": "2024-11-19T17:17:25.004Z",
    "dateUpdated": "2026-08-05T11:44:12.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:40:14.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            },
            {
              "lessThan": "7a82fe67a9f4d7123d8e5ba8f0f0806c28695006",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            },
            {
              "lessThan": "003d92c91cdb5a64b25a9a74cb8543aac9a8bb48",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            },
            {
              "lessThan": "e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            },
            {
              "lessThan": "78533c4a29ac3aeddce4b481770beaaa4f3bfb67",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            },
            {
              "lessThan": "5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            },
            {
              "lessThan": "94edfdfb9505ab608e86599d1d1e38c83816fc1c",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            },
            {
              "lessThan": "0c3057a5a04d07120b3d0ec9c79568fceb9c921e",
              "status": "affected",
              "version": "066a3b5b2346febf9a655b444567b7138e3bb939",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.84",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through RTM_NEWTCLASS rtnetlink messages (tc class add) plus locally generated traffic on a local netdev, requiring local system access. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - Exploitation is a deterministic fixed sequence \u2014 create a drr/hfsc/qfq/ets qdisc with handle ffff:, add a class with classid ffff:ffff, direct a packet to it, drop the filter, then delete the class \u2014 with no race window or attacker-uncontrollable precondition. Heap grooming to occupy the freed drr_class slab is fully under attacker control.\nPR:L - tc class creation requires only CAP_NET_ADMIN in the network namespace\u0027s owning user namespace (netlink_net_capable in rtnetlink_rcv_msg), which any unprivileged user obtains via unshare -Urn, where they can also create a dummy/veth device and generate the traffic needed. No real root in the init namespace is needed.\nUI:N - The attacker performs every step themselves \u2014 netlink configuration and packet transmission \u2014 with no action required from any other user or administrator.\nS:U - The corruption stays within the kernel\u0027s own security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The stale active-list entry produces a use-after-free on a kzalloc\u0027d drr_class object; the attacker can reclaim that slab and have the kernel read pointers and data out of attacker-adjacent memory, and the resulting primitives can be leveraged for arbitrary kernel memory disclosure.\nI:H - The UAF yields both an unlink write (list_del on freed cl-\u003ealist) and an indirect call through cl-\u003eqdisc-\u003eops-\u003epeek read from reclaimed heap memory, giving arbitrary write and control-flow hijack potential, i.e. full kernel integrity loss.\nA:H - Even without full exploitation, the dangling list entry causes a use-after-free oops in softirq context on the next dequeue, and the broken accounting permanently stalls the qdisc (drr_dequeue always returns NULL), halting transmission on the device \u2014 a repeatable kernel crash/DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:46.501Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a82fe67a9f4d7123d8e5ba8f0f0806c28695006"
        },
        {
          "url": "https://git.kernel.org/stable/c/003d92c91cdb5a64b25a9a74cb8543aac9a8bb48"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/78533c4a29ac3aeddce4b481770beaaa4f3bfb67"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/94edfdfb9505ab608e86599d1d1e38c83816fc1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c3057a5a04d07120b3d0ec9c79568fceb9c921e"
        }
      ],
      "title": "net_sched: Prevent creation of classes with TC_H_ROOT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21971",
    "datePublished": "2025-04-01T15:47:04.448Z",
    "dateReserved": "2024-12-29T08:45:45.797Z",
    "dateUpdated": "2026-08-05T11:55:46.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/mdio_bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abb0605ca00979a49572a6516f6db22c3dc57223",
              "status": "affected",
              "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a",
              "versionType": "git"
            },
            {
              "lessThan": "31bf7b2b92563a352788cf9df3698682f659bacc",
              "status": "affected",
              "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a",
              "versionType": "git"
            },
            {
              "lessThan": "4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7",
              "status": "affected",
              "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a",
              "versionType": "git"
            },
            {
              "lessThan": "260388f79e94fb3026c419a208ece8358bb7b555",
              "status": "affected",
              "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/mdio_bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\n\nWhen using publicly available tools like \u0027mdio-tools\u0027 to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through SIOCGMIIREG/SIOCSMIIREG ioctls issued on a local socket against a network device, via dev_ioctl() \u2192 dev_eth_ioctl() \u2192 phylink_mii_ioctl(). No network packet processing is involved, so this is local access only.\nAC:L - The attacker fully controls the 16-bit phy_id field and can deterministically select any out-of-bounds index from 32 to 65535, with no race, timing, or memory-layout condition outside their control; the OOB accounting happens on every call regardless of whether the underlying bus read/write succeeds.\nPR:L - The ioctl path is gated by ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is namespace-relative rather than requiring real root \u2014 an unprivileged user who is root inside a user+network namespace that owns a C45-PHY-backed netdev (SR-IOV VF or DSA user port delegated to a container) satisfies it, so this is Low rather than High.\nUI:N - The attacker triggers the entire sequence themselves with a single ioctl() call; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds access corrupts kernel heap memory from within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - mdiobus_stats_acct() performs a read-modify-write, so it reads 64-bit words at an attacker-chosen offset up to ~2 MB past the mii_bus allocation, and the resulting heap corruption can be groomed to modify length/index fields of adjacent objects to yield arbitrary kernel memory disclosure.\nI:H - The attacker gains a repeatable increment of two 64-bit words at a selectable 32-byte-granular offset far outside the allocation, which after heap grooming allows targeted modification of adjacent kernel objects (refcounts, sizes, pointer bytes) and is a viable path to control-flow hijack.\nA:H - Writing into unrelated slab objects and pages up to ~2 MB beyond the mii_bus allocation corrupts arbitrary kernel state and readily produces oopses, BUG_ONs, or a full panic, and the attacker can repeat it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:37.382Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abb0605ca00979a49572a6516f6db22c3dc57223"
        },
        {
          "url": "https://git.kernel.org/stable/c/31bf7b2b92563a352788cf9df3698682f659bacc"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7"
        },
        {
          "url": "https://git.kernel.org/stable/c/260388f79e94fb3026c419a208ece8358bb7b555"
        }
      ],
      "title": "net/mdiobus: Fix potential out-of-bounds clause 45 read/write access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38110",
    "datePublished": "2025-07-03T08:35:19.928Z",
    "dateReserved": "2025-04-16T04:51:23.985Z",
    "dateUpdated": "2026-08-05T11:59:37.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:27.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38206",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:19.143911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:21.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/exfat/nls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13d8de1b6568dcc31a95534ced16bc0c9a67bc15",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "66e84439ec2af776ce749e8540f8fdd257774152",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fd",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "1f3d9724e16d62c7d42c67d6613b8512f2887c22",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/exfat/nls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix double free in delayed_free\n\nThe double free could happen in the following path.\n\nexfat_create_upcase_table()\n        exfat_create_upcase_table() : return error\n        exfat_free_upcase_table() : free -\u003evol_utbl\n        exfat_load_default_upcase_table : return error\n     exfat_kill_sb()\n           delayed_free()\n                  exfat_free_upcase_table() \u003c--------- double free\nThis patch set -\u003evol_util as NULL after freeing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local `mount(2)`/`fsconfig(2)` path on a block device holding a crafted exfat image (removable media, loop device, or USB stick on a kiosk/Android handset). There is no remote or network data path into `exfat_create_upcase_table()`.\nAC:L - The attacker deterministically forces the first free by crafting an upcase-table dentry with a bad checksum, and can drive the required `kvcalloc` failure by generating memory/vmalloc pressure while repeatedly re-mounting the image, so success is not gated on conditions outside their influence. Consistent with prior kernel CNA scoring of allocation-failure-dependent bugs, this is Low.\nPR:L - exfat is the standard removable-media filesystem on Android and desktop Linux, where vold and udisks2 auto-mount attacker-supplied SD cards and USB sticks on behalf of the unprivileged seat/session user, so no elevated credentials are needed to reach `exfat_fill_super`. This matches the Low value assigned to the other exfat mount-time image-parsing CVEs.\nUI:N - On auto-mounting systems the crafted volume is parsed by the kernel as soon as the attacker attaches the media, and a local user with removable-media or loop-mount rights performs the entire sequence from their own process. No separate victim action is required.\nS:U - The freed `sbi-\u003evol_utbl` allocation and the resulting corruption are entirely within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The second `kvfree()` occurs in an RCU callback long after the first, so the 128 KiB region can be reallocated to an unrelated kernel object that is then released while still referenced, giving the attacker a page/vmap-level use-after-free usable as an arbitrary kernel-memory read primitive. Double-free-class corruption is scored High.\nI:H - Freeing memory that has already been reassigned lets the attacker spray controlled data into pages or vmap areas still in use by other subsystems (kernel stacks, BPF allocations, slab metadata), yielding a write primitive and control-flow hijack potential. This is full memory corruption, not a benign accounting error.\nA:H - Even without exploitation, the double free triggers a page-allocator/vfree corruption `BUG`/`WARN` in an RCU callback context or corrupts freelists, producing a kernel oops or panic. With `panic_on_warn` set, the \"Trying to vfree() nonexistent vm area\" path is an immediate full system panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:21.380Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13d8de1b6568dcc31a95534ced16bc0c9a67bc15"
        },
        {
          "url": "https://git.kernel.org/stable/c/66e84439ec2af776ce749e8540f8fdd257774152"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22"
        }
      ],
      "title": "exfat: fix double free in delayed_free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38206",
    "datePublished": "2025-07-04T13:37:25.966Z",
    "dateReserved": "2025-04-16T04:51:23.994Z",
    "dateUpdated": "2026-08-05T12:00:21.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:29.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66d29d757c968d2bee9124816da5d718eb352959",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "e3eed01347721cd7a8819568161c91d538fbf229",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "f94c422157f3e43dd31990567b3e5d54b3e5b32b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "6ca45ea48530332a4ba09595767bd26d3232743b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "cbe4134ea4bc493239786220bd69cb8a13493190",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass\n\nExport anon_inode_make_secure_inode() to allow KVM guest_memfd to create\nanonymous inodes with proper security context. This replaces the current\npattern of calling alloc_anon_inode() followed by\ninode_init_security_anon() for creating security context manually.\n\nThis change also fixes a security regression in secretmem where the\nS_PRIVATE flag was not cleared after alloc_anon_inode(), causing\nLSM/SELinux checks to be bypassed for secretmem file descriptors.\n\nAs guest_memfd currently resides in the KVM module, we need to export this\nsymbol for use outside the core kernel. In the future, guest_memfd might be\nmoved to core-mm, at which point the symbols no longer would have to be\nexported. When/if that happens is still unclear."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable object is created and operated on through local syscalls \u2014 `memfd_secret(2)`, `mmap()`, and `ftruncate()` on the resulting file descriptor. No network or adjacent-network path exists.\nAC:L - Every secretmem inode is unconditionally created with S_PRIVATE set \u2014 there is no race, no memory-layout dependency, and no timing element; the attacker simply calls memfd_secret() or receives such an fd. CONFIG_SECRETMEM defaults to y and secretmem_enable defaults to 1 since 6.6, so the affected path is present in stock distro kernels.\nPR:L - memfd_secret(2) performs no capability or permission check whatsoever, so any unprivileged local user \u2014 including one confined inside a container or user namespace \u2014 can create and operate on secretmem fds. Local account access is still required, so this is not PR:N.\nUI:N - The attacker triggers the entire sequence from their own process; no victim action, mount, or file open is needed.\nS:U - The missing enforcement affects kernel-managed objects under the kernel\u0027s own security authority; no VM, IOMMU, or hypervisor boundary is crossed. Per standard kernel scoring, MAC-policy enforcement failures remain Unchanged.\nC:H - With S_PRIVATE set, SELinux inode_has_perm() and Smack\u0027s checks return 0, so FILE__READ/FILE__MAP on a secretmem object are never evaluated \u2014 a confined domain that receives such an fd can mmap and read its contents despite policy denying it. secretmem is by design the store for the system\u0027s most sensitive data (crypto keys), and the accesses generate no AVC audit records.\nI:H - The same bypass permits PROT_WRITE shared mappings, and security_inode_setattr() is skipped entirely, so ftruncate/chown/chmod on a policy-protected secretmem object go unmediated. An attacker can overwrite or re-own another security domain\u0027s key material that the MAC policy was configured to protect.\nA:H - Because setattr and write-mapping are both unmediated, an attacker can truncate and overwrite the secretmem object a victim service depends on, destroying its key material and causing that service to fail; the unreclaimable, unmovable nature of secretmem pages compounds the effect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:34.204Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66d29d757c968d2bee9124816da5d718eb352959"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3eed01347721cd7a8819568161c91d538fbf229"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94c422157f3e43dd31990567b3e5d54b3e5b32b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ca45ea48530332a4ba09595767bd26d3232743b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbe4134ea4bc493239786220bd69cb8a13493190"
        }
      ],
      "title": "fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38396",
    "datePublished": "2025-07-25T12:53:40.761Z",
    "dateReserved": "2025-04-16T04:51:24.011Z",
    "dateUpdated": "2026-08-05T12:01:34.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/msg_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "094ba14a471cc6c68078c7ad488539eaf32c2277",
              "status": "affected",
              "version": "0617bb500bfabf8447062f1e1edde92ed2b638f1",
              "versionType": "git"
            },
            {
              "lessThan": "e5b3432f4a6b418b8bd8fc91f38efbf17a77167a",
              "status": "affected",
              "version": "0617bb500bfabf8447062f1e1edde92ed2b638f1",
              "versionType": "git"
            },
            {
              "lessThan": "fc582cd26e888b0652bc1494f252329453fd3b23",
              "status": "affected",
              "version": "0617bb500bfabf8447062f1e1edde92ed2b638f1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/io_uring_types.h",
            "io_uring/msg_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU\n\nsyzbot reports that defer/local task_work adding via msg_ring can hit\na request that has been freed:\n\nCPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xd2/0x2b0 mm/kasan/report.c:521\n kasan_report+0x118/0x150 mm/kasan/report.c:634\n io_req_local_work_add io_uring/io_uring.c:1184 [inline]\n __io_req_task_work_add+0x589/0x950 io_uring/io_uring.c:1252\n io_msg_remote_post io_uring/msg_ring.c:103 [inline]\n io_msg_data_remote io_uring/msg_ring.c:133 [inline]\n __io_msg_ring_data+0x820/0xaa0 io_uring/msg_ring.c:151\n io_msg_ring_data io_uring/msg_ring.c:173 [inline]\n io_msg_ring+0x134/0xa00 io_uring/msg_ring.c:314\n __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1739\n io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1762\n io_wq_submit_work+0x6e9/0xb90 io_uring/io_uring.c:1874\n io_worker_handle_work+0x7cd/0x1180 io_uring/io-wq.c:642\n io_wq_worker+0x42f/0xeb0 io_uring/io-wq.c:696\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nwhich is supposed to be safe with how requests are allocated. But msg\nring requests alloc and free on their own, and hence must defer freeing\nto a sane time.\n\nAdd an rcu_head and use kfree_rcu() in both spots where requests are\nfreed. Only the one in io_msg_tw_complete() is strictly required as it\nhas been visible on the other ring, but use it consistently in the other\nspot as well.\n\nThis should not cause any other issues outside of KASAN rightfully\ncomplaining about it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached purely through the io_uring syscall interface (`io_uring_setup()` plus `io_uring_enter()` submitting `IORING_OP_MSG_RING`), requiring local access to the machine or a container on it. Per kernel scoring guidance io_uring bugs are Local.\nAC:L - The attacker creates and fully controls both sides of the race \u2014 the target ring (with `IORING_SETUP_DEFER_TASKRUN|SINGLE_ISSUER`), the flood of MSG_RING requests from io-wq workers on one CPU, and the reaping task that frees those requests on another \u2014 so it can be hit repeatedly at will, as syzbot\u0027s reproducer demonstrates. No precondition lies outside the attacker\u0027s influence; the required ring flags are runtime choices, not a rare build config.\nPR:L - Any unprivileged local user can create io_uring instances and submit `IORING_OP_MSG_RING`; there is no capability, credential, or LSM gate anywhere along `io_msg_ring() \u2192 io_msg_data_remote() \u2192 io_req_local_work_add()`, and `kernel.io_uring_disabled` is 0 by default. The path is equally reachable from inside an unprivileged container or user namespace.\nUI:N - Exploitation is entirely self-driven by the attacker\u0027s own two threads submitting and reaping io_uring requests. No victim action, mount, or file access is involved.\nS:U - The freed `io_kiocb` and the code dereferencing it both live in the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed. Standard kernel-local impact.\nC:H - A freed `io_kiocb` from the shared `req_cachep` slab is dereferenced after `kmem_cache_free()`, and an attacker who grooms slab reuse controls what object occupies that memory when it is read. Consistent with treating use-after-free as enabling attacker-influenced disclosure of kernel memory contents, this is High.\nI:H - The stale read feeds the `nr_tw` value written into the newly queued request and drives the task-wakeup decision, so freed/reallocated memory directly influences kernel control state. Use-after-free conditions on a heap-spray-friendly cache such as `io_kiocb` are treated as High integrity impact.\nA:H - This is a confirmed KASAN slab-use-after-free that panics kernels built with KASAN or `panic_on_warn`, and on production kernels a garbage `nr_tw_prev` can exceed `cq_wait_nr` and suppress the `wake_up_state()` of the target ring\u0027s submitter, stalling a task that is waiting on already-queued work. Both outcomes are triggerable repeatedly by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:00.377Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/094ba14a471cc6c68078c7ad488539eaf32c2277"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5b3432f4a6b418b8bd8fc91f38efbf17a77167a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc582cd26e888b0652bc1494f252329453fd3b23"
        }
      ],
      "title": "io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38453",
    "datePublished": "2025-07-25T15:27:33.374Z",
    "dateReserved": "2025-04-16T04:51:24.018Z",
    "dateUpdated": "2026-08-05T12:02:00.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:36.234Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:10.201Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_strp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "730fed2ff5e259495712518e18d9f521f61972bb",
              "status": "affected",
              "version": "0d87bbd39d7fd1135ab9eca672d760470f6508e8",
              "versionType": "git"
            },
            {
              "lessThan": "1f3a429c21e0e43e8b8c55d30701e91411a4df02",
              "status": "affected",
              "version": "0d87bbd39d7fd1135ab9eca672d760470f6508e8",
              "versionType": "git"
            },
            {
              "lessThan": "cdb767915fc9a15d88d19d52a1455f1dc3e5ddc8",
              "status": "affected",
              "version": "0d87bbd39d7fd1135ab9eca672d760470f6508e8",
              "versionType": "git"
            },
            {
              "lessThan": "c76f6f437c46b2390888e0e1dc7aafafa9f4e0c6",
              "status": "affected",
              "version": "0d87bbd39d7fd1135ab9eca672d760470f6508e8",
              "versionType": "git"
            },
            {
              "lessThan": "4ab26bce3969f8fd925fe6f6f551e4d1a508c68b",
              "status": "affected",
              "version": "0d87bbd39d7fd1135ab9eca672d760470f6508e8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2277d7cbdf47531b2c3cd01ba15255fa955aab35",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_strp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: always refresh the queue when reading sock\n\nAfter recent changes in net-next TCP compacts skbs much more\naggressively. This unearthed a bug in TLS where we may try\nto operate on an old skb when checking if all skbs in the\nqueue have matching decrypt state and geometry.\n\n    BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls]\n    (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544)\n    Read of size 4 at addr ffff888013085750 by task tls/13529\n\n    CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme\n    Call Trace:\n     kasan_report+0xca/0x100\n     tls_strp_check_rcv+0x898/0x9a0 [tls]\n     tls_rx_rec_wait+0x2c9/0x8d0 [tls]\n     tls_sw_recvmsg+0x40f/0x1aa0 [tls]\n     inet_recvmsg+0x1c3/0x1f0\n\nAlways reload the queue, fast path is to have the record in the queue\nwhen we wake, anyway (IOW the path going down \"if !strp-\u003estm.full_len\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the kTLS receive strparser, driven directly from the TCP `sk_data_ready` softirq hook and from `recvmsg()` on data supplied by the remote TLS peer. A remote attacker triggers it purely by choosing TLS record framing and TCP segment sizes/timing on an ordinary connection to a kTLS-enabled service.\nAC:L - The attacker controls every side of the condition \u2014 the record header that sets `stm.full_len`, the many small/large segments that push `sk_rmem_alloc` past `sk_rcvbuf` to force `tcp_collapse()` to free the anchored skb, and the final segment that makes `inq \u003e= full_len` \u2014 and can retry indefinitely across parallel connections. It was hit by the plain in-tree `tls` selftest, not an exotic race.\nPR:N - The attacker is the remote peer of a TLS connection and needs no account or privilege on the target; kTLS servers (nginx/HAProxy with kTLS offload, TLS-terminating proxies) accept connections from anonymous clients and enable `TLS_RX` right after the handshake.\nUI:N - The victim application merely receives data on an already-established kTLS socket; the strparser runs from softirq on packet arrival with no local user action required.\nS:U - The corruption is confined to kernel skb/slab memory of the affected host, with no crossing of a VM, IOMMU, or sandbox security authority.\nC:H - This is a slab use-after-free read: freed skb metadata is read, and the attacker-influenced `skb-\u003enext` chain lets the loop walk into reallocated memory, giving an arbitrary-address read oracle via the true/false result; freed pages are further fed into the AEAD scatterlist by `skb_to_sgvec()`.\nI:H - Use-after-free with heap grooming yields write primitives \u2014 `tls_strp_msg_hold()` performs `skb_clone()` on the freed skbs, writing refcounts into reallocated objects, and the stale `frag_list` drives crypto operations over freed memory, which is exploitable for control-flow hijacking.\nA:H - KASAN confirms a slab-use-after-free, and the unbounded `skb = skb-\u003enext` walk over freed memory readily faults on a wild pointer, producing a kernel oops/panic that a remote attacker can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:10.110Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/730fed2ff5e259495712518e18d9f521f61972bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f3a429c21e0e43e8b8c55d30701e91411a4df02"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdb767915fc9a15d88d19d52a1455f1dc3e5ddc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c76f6f437c46b2390888e0e1dc7aafafa9f4e0c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ab26bce3969f8fd925fe6f6f551e4d1a508c68b"
        }
      ],
      "title": "tls: always refresh the queue when reading sock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38471",
    "datePublished": "2025-07-28T11:21:32.927Z",
    "dateReserved": "2025-04-16T04:51:24.021Z",
    "dateUpdated": "2026-08-05T12:02:10.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:08.627Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:14.206Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "36fecd740de2d542d2091d65d36554ee2bcf9c65",
              "status": "affected",
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "versionType": "git"
            },
            {
              "lessThan": "d717325b5ecf2a40daca85c61923e17f32306179",
              "status": "affected",
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "versionType": "git"
            },
            {
              "lessThan": "dc6a664089f10eab0fb36b6e4f705022210191d2",
              "status": "affected",
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "versionType": "git"
            },
            {
              "lessThan": "e77078e52fbf018ab986efb3c79065ab35025607",
              "status": "affected",
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "versionType": "git"
            },
            {
              "lessThan": "38628ae06e2a37770cd794802a3f1310cf9846e3",
              "status": "affected",
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "versionType": "git"
            },
            {
              "lessThan": "c28f922c9dcee0e4876a2c095939d77fe7e15116",
              "status": "affected",
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c6e8810d25295acb40a7b69ed3962ff181919571",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3eee87c846dc47f6d8eb6d85e7271f24122a279",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "963d85d630dabe75a3cfde44a006fec3304d07b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "812f39ed5b0b7f34868736de3055c92c7c4cf459",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6a002d48a66076524f67098132538bef17e8445e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "41812f4b84484530057513478c6770590347dc30",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.281",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.280",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.244",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.204",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.141",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.59",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.281",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.280",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.244",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.204",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won\u0027t expose something\nhidden by a mount we wouldn\u0027t be able to undo.  \"Wouldn\u0027t be able to undo\"\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere\u0027s a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local filesystem syscalls (fsopen/fsconfig/fsmount or mount(2)) issued by a process on the machine. There is no remote or adjacent-network exposure of clone_private_mount().\nAC:L - The attacker deterministically controls every step \u2014 creating the user namespace, opening the fs_context, passing the fd, and issuing FSCONFIG_CMD_CREATE from the confined mount namespace \u2014 with no race, no memory-layout dependency, and no reliance on any condition outside their control.\nPR:L - An ordinary unprivileged local user suffices: unshare(CLONE_NEWUSER|CLONE_NEWNS) yields CAP_SYS_ADMIN in a child userns for the fsopen(), and setns() back into that userns as its owner lets the same uid drive fsconfig() from the restricted mount namespace where it holds no privileges at all.\nUI:N - The entire sequence is performed by the attacker\u0027s own processes; no victim action, mount operation, or file access by another user is required.\nS:U - The bypassed mount visibility and the exposed files are all managed by the same kernel security authority; no VM, hypervisor, or IOMMU boundary is crossed.\nC:H - The private clone omits all child mounts, so entire directory trees deliberately concealed by mask/over-mounts the attacker cannot unmount (container masked paths, systemd InaccessiblePaths=/ProtectHome=, sandbox hiding mounts) become readable through the overlay lower layer.\nI:H - Using the same primitive for upperdir on a read-write parent mount discards read-only child bind mounts, giving direct write, create, and delete access to trees that mount-based hardening (ReadOnlyPaths=, ProtectSystem=strict, container ro binds) was enforcing as immutable.\nA:H - That regained write access covers the exact paths the confinement was protecting, so an attacker can overwrite or delete critical configuration and system files inside a hardened service or container and render it \u2014 or the host \u2014 inoperable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:26.265Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65"
        },
        {
          "url": "https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607"
        },
        {
          "url": "https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116"
        }
      ],
      "title": "clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38499",
    "datePublished": "2025-08-11T16:01:08.257Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:26.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_lmtt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            },
            {
              "lessThan": "5d21892c2e15b6a27f8bc907693eca7c6b7cc269",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            },
            {
              "lessThan": "705a412a367f383430fa34bada387af2e52eb043",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_lmtt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Clear all LMTT pages on alloc\n\nOur LMEM buffer objects are not cleared by default on alloc\nand during VF provisioning we only setup LMTT PTEs for the\nactually provisioned LMEM range. But beyond that valid range\nwe might leave some stale data that could either point to some\nother VFs allocations or even to the PF pages.\n\nExplicitly clear all new LMTT page to avoid the risk that a\nmalicious VF would try to exploit that gap.\n\nWhile around add asserts to catch any undesired PTE overwrites\nand low-level debug traces to track LMTT PT life-cycle.\n\n(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires executing code on a system with an Xe SR-IOV Virtual Function assigned (a guest VM or container), driving GPU accesses to LMEM offsets above the provisioned quota via the VF\u0027s own GGTT/PPGTT entries. No network protocol is involved.\nAC:L - The gap is deterministic and present on every VF provisioning \u2014 no race, no timing window; with tens of thousands of uninitialized dwords and only a 1-bit validity check, thousands of usable rogue mappings are essentially guaranteed, and the VF can additionally groom VRAM with crafted PTE patterns before re-provisioning.\nPR:L - The attacker needs control of a VF (guest-side driver privileges to emit out-of-range LMEM offsets) but holds no privileges whatsoever on the host/PF that owns the vulnerable LMTT; relative to the vulnerable component this is a low, tenant-level authorization.\nUI:N - No victim action is required at exploit time \u2014 the VF simply accesses LMEM beyond its quota. PF-side SR-IOV provisioning is pre-existing administrative setup in any deployment where this code runs.\nS:C - The LMTT is the only hardware mechanism isolating a VF\u0027s local memory from the PF and other VFs, so bypassing it lets a guest reach memory belonging to the host and to other tenants \u2014 the DMA/IOMMU-boundary-bypass case, directly analogous to a guest-to-host escape.\nC:H - Stale valid PTEs map arbitrary 2 MiB-aligned pages across the device\u0027s entire local memory address space (32/128 GiB for 2L, 256 TiB for ML), letting the VF read PF driver allocations and other tenants\u0027 framebuffers and compute data.\nI:H - LMTT PTEs carry no read-only bit, so the VF also writes through the rogue mappings; landing on the LMTT PD/PT pages themselves yields deterministic arbitrary VRAM mapping, and landing on PF/other-VF PPGTT page-table BOs (allocated in VRAM on dGFX) lets the VF redirect another domain\u0027s GPU accesses, including to host system memory.\nA:H - Corrupting PF or peer-VF VRAM \u2014 GPU page tables, GuC context state and firmware images all live in local memory \u2014 causes GPU hangs, engine resets, wedged-device conditions and host driver failure, denying service to the host and every other tenant on the GPU."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:32.680Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269"
        },
        {
          "url": "https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043"
        }
      ],
      "title": "drm/xe/pf: Clear all LMTT pages on alloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38511",
    "datePublished": "2025-08-16T10:54:53.346Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:32.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}