Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0930
Vulnerability from certfr_avis - Published: 2026-07-24 - Updated: 2026-07-24
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.96-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-53027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53027"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2025-21807",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21807"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63816"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-53226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53226"
},
{
"name": "CVE-2026-46093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46093"
}
],
"initial_release_date": "2026-07-24T00:00:00",
"last_revision_date": "2026-07-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0930",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00304",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00304.html"
}
]
}
CVE-2025-21807 (GCVE-0-2025-21807)
Vulnerability from cvelistv5 – Published: 2025-02-27 20:00 – Updated: 2026-07-18 15:00
VLAI
EPSS
VEX
Title
block: fix queue freeze vs limits lock order in sysfs store methods
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: fix queue freeze vs limits lock order in sysfs store methods
queue_attr_store() always freezes a device queue before calling the
attribute store operation. For attributes that control queue limits, the
store operation will also lock the queue limits with a call to
queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may
need to issue commands to a device to obtain limit values from the
hardware with the queue limits locked. This creates a potential ABBA
deadlock situation if a user attempts to modify a limit (thus freezing
the device queue) while the device driver starts a revalidation of the
device queue limits.
Avoid such deadlock by not freezing the queue before calling the
->store_limit() method in struct queue_sysfs_entry and instead use the
queue_limits_commit_update_frozen helper to freeze the queue after taking
the limits lock.
This also removes taking the sysfs lock for the store_limit method as
it doesn't protect anything here, but creates even more nesting.
Hopefully it will go away from the actual sysfs methods entirely soon.
(commit log adapted from a similar patch from Damien Le Moal)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0327ca9d53bfbb0918867313049bba7046900f73 , < 1645cd7fd42c236c952e9228badcac4fea1829ea
(git)
Affected: 0327ca9d53bfbb0918867313049bba7046900f73 , < 8985da5481562e96b95e94ed8e5cc9b6565eb82b (git) Affected: 0327ca9d53bfbb0918867313049bba7046900f73 , < c99f66e4084a62a2cc401c4704a84328aeddc9ec (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.13.2 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1645cd7fd42c236c952e9228badcac4fea1829ea",
"status": "affected",
"version": "0327ca9d53bfbb0918867313049bba7046900f73",
"versionType": "git"
},
{
"lessThan": "8985da5481562e96b95e94ed8e5cc9b6565eb82b",
"status": "affected",
"version": "0327ca9d53bfbb0918867313049bba7046900f73",
"versionType": "git"
},
{
"lessThan": "c99f66e4084a62a2cc401c4704a84328aeddc9ec",
"status": "affected",
"version": "0327ca9d53bfbb0918867313049bba7046900f73",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.13.*",
"status": "unaffected",
"version": "6.13.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.14",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.2",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix queue freeze vs limits lock order in sysfs store methods\n\nqueue_attr_store() always freezes a device queue before calling the\nattribute store operation. For attributes that control queue limits, the\nstore operation will also lock the queue limits with a call to\nqueue_limits_start_update(). However, some drivers (e.g. SCSI sd) may\nneed to issue commands to a device to obtain limit values from the\nhardware with the queue limits locked. This creates a potential ABBA\ndeadlock situation if a user attempts to modify a limit (thus freezing\nthe device queue) while the device driver starts a revalidation of the\ndevice queue limits.\n\nAvoid such deadlock by not freezing the queue before calling the\n-\u003estore_limit() method in struct queue_sysfs_entry and instead use the\nqueue_limits_commit_update_frozen helper to freeze the queue after taking\nthe limits lock.\n\nThis also removes taking the sysfs lock for the store_limit method as\nit doesn\u0027t protect anything here, but creates even more nesting.\nHopefully it will go away from the actual sysfs methods entirely soon.\n\n(commit log adapted from a similar patch from Damien Le Moal)"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T15:00:42.201Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1645cd7fd42c236c952e9228badcac4fea1829ea"
},
{
"url": "https://git.kernel.org/stable/c/8985da5481562e96b95e94ed8e5cc9b6565eb82b"
},
{
"url": "https://git.kernel.org/stable/c/c99f66e4084a62a2cc401c4704a84328aeddc9ec"
}
],
"title": "block: fix queue freeze vs limits lock order in sysfs store methods",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-21807",
"datePublished": "2025-02-27T20:00:59.560Z",
"dateReserved": "2024-12-29T08:45:45.772Z",
"dateUpdated": "2026-07-18T15:00:42.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46093 (GCVE-0-2026-46093)
Vulnerability from cvelistv5 – Published: 2026-05-27 12:58 – Updated: 2026-07-18 15:00
VLAI
EPSS
VEX
Title
mm/vmalloc: take vmap_purge_lock in shrinker
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: take vmap_purge_lock in shrinker
decay_va_pool_node() can be invoked concurrently from two paths:
__purge_vmap_area_lazy() when pools are being purged, and the shrinker via
vmap_node_shrink_scan().
However, decay_va_pool_node() is not safe to run concurrently, and the
shrinker path currently lacks serialization, leading to races and possible
leaks.
Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker
path to ensure serialization with purge users.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7679ba6b36dbb300b757b672d6a32a606499e14b , < c15ff206ba78820bf2873d0c668a882e99f4b631
(git)
Affected: 7679ba6b36dbb300b757b672d6a32a606499e14b , < 687ccdf582169cd680aeaf24cc953807c4cd4345 (git) Affected: 7679ba6b36dbb300b757b672d6a32a606499e14b , < 12f2341b4c235d5593a433abac201c1c6725787f (git) Affected: 7679ba6b36dbb300b757b672d6a32a606499e14b , < ec05f51f1e65bce95528543eb73fda56fd201d94 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c15ff206ba78820bf2873d0c668a882e99f4b631",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "687ccdf582169cd680aeaf24cc953807c4cd4345",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "12f2341b4c235d5593a433abac201c1c6725787f",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "ec05f51f1e65bce95528543eb73fda56fd201d94",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: take vmap_purge_lock in shrinker\n\ndecay_va_pool_node() can be invoked concurrently from two paths:\n__purge_vmap_area_lazy() when pools are being purged, and the shrinker via\nvmap_node_shrink_scan().\n\nHowever, decay_va_pool_node() is not safe to run concurrently, and the\nshrinker path currently lacks serialization, leading to races and possible\nleaks.\n\nProtect decay_va_pool_node() by taking vmap_purge_lock in the shrinker\npath to ensure serialization with purge users."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T15:00:45.339Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c15ff206ba78820bf2873d0c668a882e99f4b631"
},
{
"url": "https://git.kernel.org/stable/c/687ccdf582169cd680aeaf24cc953807c4cd4345"
},
{
"url": "https://git.kernel.org/stable/c/12f2341b4c235d5593a433abac201c1c6725787f"
},
{
"url": "https://git.kernel.org/stable/c/ec05f51f1e65bce95528543eb73fda56fd201d94"
}
],
"title": "mm/vmalloc: take vmap_purge_lock in shrinker",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46093",
"datePublished": "2026-05-27T12:58:43.458Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-07-18T15:00:45.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53027 (GCVE-0-2026-53027)
Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-07-24 14:33
VLAI
EPSS
VEX
Title
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
When a compressed or sparse attribute has its clusters frame-aligned,
vcn is rounded down to the frame start using cmask, which can result
in vcn != vcn0. In this case, vcn and vcn0 may reside in different
attribute segments.
The code already handles the case where vcn is in a different segment
by loading its runs before allocation. However, it fails to load runs
for vcn0 when vcn0 resides in a different segment than vcn. This causes
run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was
never loaded into the in-memory run list, triggering the WARN_ON(1).
Fix this by adding a missing check for vcn0 after the existing vcn
segment check. If vcn0 falls outside the current segment range
[svcn, evcn1), find and load the attribute segment containing vcn0
before performing the run lookup.
The following scenario triggers the bug:
attr_data_get_block_locked()
vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment
load runs for vcn segment <- vcn0 segment not loaded!
attr_allocate_clusters() <- allocation succeeds
run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN
WARN_ON(1) <- bug fires here!
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < ea59d9dbc5504e29d420ac4aab774cbce39b0e69
(git)
Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < d68a14450783ecc5fddae957ac4e1c546dfcfb73 (git) Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < 08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147 (git) Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < 2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54 (git) Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < d7ea8495fd307b58f8867acd81a1b40075b1d3ba (git) Affected: 406a037d93b769bca248476bd14bbe548dc1ec35 (git) Affected: 6.1.132 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/attrib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea59d9dbc5504e29d420ac4aab774cbce39b0e69",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "d68a14450783ecc5fddae957ac4e1c546dfcfb73",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "d7ea8495fd307b58f8867acd81a1b40075b1d3ba",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"status": "affected",
"version": "406a037d93b769bca248476bd14bbe548dc1ec35",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.132",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/attrib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()\n\nWhen a compressed or sparse attribute has its clusters frame-aligned,\nvcn is rounded down to the frame start using cmask, which can result\nin vcn != vcn0. In this case, vcn and vcn0 may reside in different\nattribute segments.\n\nThe code already handles the case where vcn is in a different segment\nby loading its runs before allocation. However, it fails to load runs\nfor vcn0 when vcn0 resides in a different segment than vcn. This causes\nrun_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was\nnever loaded into the in-memory run list, triggering the WARN_ON(1).\n\nFix this by adding a missing check for vcn0 after the existing vcn\nsegment check. If vcn0 falls outside the current segment range\n[svcn, evcn1), find and load the attribute segment containing vcn0\nbefore performing the run lookup.\n\nThe following scenario triggers the bug:\n attr_data_get_block_locked()\n vcn = vcn0 \u0026 cmask \u003c- vcn != vcn0 after frame alignment\n load runs for vcn segment \u003c- vcn0 segment not loaded!\n attr_allocate_clusters() \u003c- allocation succeeds\n run_lookup_entry(vcn0) \u003c- vcn0 not in run -\u003e SPARSE_LCN\n WARN_ON(1) \u003c- bug fires here!"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:33:47.674Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69"
},
{
"url": "https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73"
},
{
"url": "https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147"
},
{
"url": "https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54"
},
{
"url": "https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba"
}
],
"title": "fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53027",
"datePublished": "2026-06-24T16:29:35.740Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-07-24T14:33:47.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53226 (GCVE-0-2026-53226)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-07-18 15:00
VLAI
EPSS
VEX
Title
gpio: rockchip: fix generic IRQ chip leak on remove
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: rockchip: fix generic IRQ chip leak on remove
The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove/teardown, the generic chips are not automatically freed when the
IRQ domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.
This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the GPIO bank has been removed,
potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
rockchip_gpio_remove().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
936ee2675eee1faca0dcdfa79165c7990422e0fc , < 50c7a6d2bf179588ba2daee97be93d19c96a94af
(git)
Affected: 936ee2675eee1faca0dcdfa79165c7990422e0fc , < bace7b99bfa555fe833aee8827b8004c43666d02 (git) Affected: 936ee2675eee1faca0dcdfa79165c7990422e0fc , < 1f34ea5f6114011092d9a5c8b901ad6741144a1d (git) Affected: 936ee2675eee1faca0dcdfa79165c7990422e0fc , < 1c1e0fc88d6ef65bf15d517853251f75ab9d18c3 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-rockchip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50c7a6d2bf179588ba2daee97be93d19c96a94af",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
},
{
"lessThan": "bace7b99bfa555fe833aee8827b8004c43666d02",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
},
{
"lessThan": "1f34ea5f6114011092d9a5c8b901ad6741144a1d",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
},
{
"lessThan": "1c1e0fc88d6ef65bf15d517853251f75ab9d18c3",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-rockchip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: rockchip: fix generic IRQ chip leak on remove\n\nThe driver allocates domain generic chips using\nirq_alloc_domain_generic_chips() during probe. However, on driver\nremove/teardown, the generic chips are not automatically freed when the\nIRQ domain is removed because the domain flags do not include\nIRQ_DOMAIN_FLAG_DESTROY_GC.\n\nThis causes both the domain generic chips structure and the associated\ngeneric chips to be leaked. Additionally, the generic chips remain on\nthe global gc_list and may later be visited by generic IRQ chip suspend,\nresume, or shutdown callbacks after the GPIO bank has been removed,\npotentially resulting in a use-after-free and kernel crash.\n\nFix the resource leak by explicitly calling\nirq_domain_remove_generic_chips() before removing the IRQ domain in\nrockchip_gpio_remove()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T15:00:47.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50c7a6d2bf179588ba2daee97be93d19c96a94af"
},
{
"url": "https://git.kernel.org/stable/c/bace7b99bfa555fe833aee8827b8004c43666d02"
},
{
"url": "https://git.kernel.org/stable/c/1f34ea5f6114011092d9a5c8b901ad6741144a1d"
},
{
"url": "https://git.kernel.org/stable/c/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"
}
],
"title": "gpio: rockchip: fix generic IRQ chip leak on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53226",
"datePublished": "2026-06-25T08:39:26.567Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-07-18T15:00:47.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53392 (GCVE-0-2026-53392)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-07-24 14:33
VLAI
EPSS
VEX
Title
NFSv4/flexfiles: reject zero filehandle version count
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: reject zero filehandle version count
ff_layout_alloc_lseg() decodes the filehandle-version array count
from the flexfiles layout body. The value is used as the count for
kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in
dss_info->fh_versions even though later flexfiles paths assume that at
least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero
version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750
ff_layout_encode_layoutreturn+0x683/0x970
nfs4_xdr_enc_layoutreturn+0x278/0x3a0
Kernel panic - not syncing: Fatal exception
The patched kernel rejects the malformed layout without KASAN/oops/panic,
and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
Severity
7.5 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d67ae825a59d639e4d8b82413af84d854617a87e , < 9033591535c066726f5b505126ccb4068b98fa4f
(git)
Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < be7829715e341b42846437dd9e721005db59f0cc (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < eeabb9020721db6bc132e68eeae380b8d4fb4b04 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 7779c85028a0676fb190cde4f0c540f4f8e97761 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < d8c90c7cc061265d5f2813a1f5c82ef2f4707e67 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 2131ed64b767ffa8bcdb3677d90f3964e39aabc8 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/flexfilelayout/flexfilelayout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9033591535c066726f5b505126ccb4068b98fa4f",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "18cc6d57a14fa65ab2a2b52279f549041c4bc9cf",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "be7829715e341b42846437dd9e721005db59f0cc",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "eeabb9020721db6bc132e68eeae380b8d4fb4b04",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "7779c85028a0676fb190cde4f0c540f4f8e97761",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "d8c90c7cc061265d5f2813a1f5c82ef2f4707e67",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "2131ed64b767ffa8bcdb3677d90f3964e39aabc8",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/flexfilelayout/flexfilelayout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: reject zero filehandle version count\n\nff_layout_alloc_lseg() decodes the filehandle-version array count\nfrom the flexfiles layout body. The value is used as the count for\nkzalloc_objs(), and the current code only rejects NULL.\n\nA zero count yields ZERO_SIZE_PTR, which can be stored in\ndss_info-\u003efh_versions even though later flexfiles paths assume that at\nleast one filehandle version exists.\n\nReject fh_count == 0 before the allocation, matching the existing zero\nversion_count validation in the flexfiles GETDEVICEINFO parser.\n\nA QEMU/KASAN run with a malformed flexfiles layout hit:\n\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750\n ff_layout_encode_layoutreturn+0x683/0x970\n nfs4_xdr_enc_layoutreturn+0x278/0x3a0\n Kernel panic - not syncing: Fatal exception\n\nThe patched kernel rejects the malformed layout without KASAN/oops/panic,\nand a valid fh_count=1 regression still opens, reads, and unmounts cleanly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:33:58.026Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f"
},
{
"url": "https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf"
},
{
"url": "https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc"
},
{
"url": "https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04"
},
{
"url": "https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761"
},
{
"url": "https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67"
},
{
"url": "https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8"
},
{
"url": "https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2"
}
],
"title": "NFSv4/flexfiles: reject zero filehandle version count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53392",
"datePublished": "2026-07-19T12:01:56.101Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-07-24T14:33:58.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53399 (GCVE-0-2026-53399)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-24 14:34
VLAI
EPSS
VEX
Title
nfsd: release layout stid on setlease failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: release layout stid on setlease failure
nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
idr_alloc_cyclic() under cl_lock before returning to
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
fails, the error path frees the layout stateid directly with
kmem_cache_free() without ever calling idr_remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states_show, client teardown) dereferences the dangling pointer.
The correct teardown for an IDR-published stid is nfs4_put_stid(),
which removes the IDR slot under cl_lock, dispatches sc_free
(nfsd4_free_layout_stateid) to release ls->ls_file via
nfsd4_close_layout(), and drops the nfs4_file reference in its
tail.
A second issue blocks that switch: nfsd4_free_layout_stateid()
unconditionally inspects ls->ls_fence_work via
delayed_work_pending() under ls_lock, but
INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed_work.
nfsd4_alloc_layout_stateid()
nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */
nfsd4_layout_setlease() /* fails */
nfs4_put_stid()
nfsd4_free_layout_stateid()
delayed_work_pending(&ls->ls_fence_work) /* needs INIT */
nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */
put_nfs4_file()
Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK
initialization above the nfsd4_layout_setlease() call, and replace
the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup
with a single nfs4_put_stid(stp).
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c5c707f96fc9a6e5a57ca5baac892673270abe3d , < d788ef40a7517d22c97ab01700e4ae4c611b6f2f
(git)
Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 7bbb7ce74051c8be4b69ff44ce3db370600dae61 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 48a586e382e4db1dbf958d44b63e081df5f8ed04 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < d369e5edfaaf83a448016e2f1da392b2174be801 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 83c2b7797742339bb768f83935f7ca33950db138 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4layouts.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d788ef40a7517d22c97ab01700e4ae4c611b6f2f",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "2e0a5d6d62600b8c614d1b55e50ef94035d6adf9",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "7bbb7ce74051c8be4b69ff44ce3db370600dae61",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "48a586e382e4db1dbf958d44b63e081df5f8ed04",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "d369e5edfaaf83a448016e2f1da392b2174be801",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "83c2b7797742339bb768f83935f7ca33950db138",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "30d55c8aabb261bc3f427d6b9aae7ef6206063f9",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4layouts.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl-\u003ecl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls-\u003els_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls-\u003els_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(\u0026ls-\u003els_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n nfsd4_alloc_layout_stateid()\n nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */\n nfsd4_layout_setlease() /* fails */\n nfs4_put_stid()\n nfsd4_free_layout_stateid()\n delayed_work_pending(\u0026ls-\u003els_fence_work) /* needs INIT */\n nfsd4_close_layout() /* nfsd_file_put(ls-\u003els_file) */\n put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:34:01.063Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f"
},
{
"url": "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9"
},
{
"url": "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61"
},
{
"url": "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04"
},
{
"url": "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801"
},
{
"url": "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd"
},
{
"url": "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138"
},
{
"url": "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9"
}
],
"title": "nfsd: release layout stid on setlease failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53399",
"datePublished": "2026-07-19T12:02:00.055Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-07-24T14:34:01.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53402 (GCVE-0-2026-53402)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-24 14:34
VLAI
EPSS
VEX
Title
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.
Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.
This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.
Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
868749a7456dc48e93887a8474194e2ee6d6c21f , < cb016bcb40c81e7b19c4ae6143babb366dae8e20
(git)
Affected: ebd6f886aa2447fcfcdce5450c9e1028e1d681bb , < ac562193c36696513ae196171892e9338475c4bc (git) Affected: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 , < 3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5 (git) Affected: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 , < a7a526fbc847f07ad3a503c7382189be5ab68574 (git) Affected: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 , < b5bb2c696e140c399cb874def2feedf61dee27d6 (git) Affected: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 , < 076b1aa65f77a49bce5a48a4a55a397cfcafa2b8 (git) Affected: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 , < 39815715cbcfabb16fc8c5f4a23deeda20f5df62 (git) Affected: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 , < 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2 (git) Affected: f08ccb792d3eaf1dc62d8cbf6a30d6522329f660 (git) Affected: 5.10.249 , < 5.10.261 (semver) Affected: 5.15.64 , < 5.15.212 (semver) Affected: 5.19.6 , < 5.20 (semver) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb016bcb40c81e7b19c4ae6143babb366dae8e20",
"status": "affected",
"version": "868749a7456dc48e93887a8474194e2ee6d6c21f",
"versionType": "git"
},
{
"lessThan": "ac562193c36696513ae196171892e9338475c4bc",
"status": "affected",
"version": "ebd6f886aa2447fcfcdce5450c9e1028e1d681bb",
"versionType": "git"
},
{
"lessThan": "3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "a7a526fbc847f07ad3a503c7382189be5ab68574",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "b5bb2c696e140c399cb874def2feedf61dee27d6",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "076b1aa65f77a49bce5a48a4a55a397cfcafa2b8",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "39815715cbcfabb16fc8c5f4a23deeda20f5df62",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"status": "affected",
"version": "f08ccb792d3eaf1dc62d8cbf6a30d6522329f660",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.249",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.64",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.249",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()\n\nWhen fbcon_do_set_font() fails (e.g., due to a memory allocation failure\ninside vc_resize() under heavy memory pressure), it jumps to the `err_out`\nlabel to roll back the console state. However, the current rollback logic\nforgets to restore the `hi_font` state, leading to a severe state machine\ncorruption.\n\nEarlier in the function, `set_vc_hi_font()` might be called to change\n`vc-\u003evc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`\nsubsequently fails, the `err_out` path restores `vc_font.charcount`\nbut entirely skips rolling back the `vc_hi_font_mask` and the screen\nbuffer.\n\nThis mismatch leaves the terminal in a desynchronized state. Because\n`vc_hi_font_mask` remains set, the VT subsystem will still accept\ncharacter indices greater than 255 from userspace and write them to the\nscreen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will\nthen use these inflated indices to access the reverted, 256-character\nfont array, leading to a deterministic out-of-bounds read and potential\nkernel memory disclosure.\n\nFix this by adding the missing rollback logic for the `hi_font` mask\nand screen buffer in the error path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:34:03.280Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb016bcb40c81e7b19c4ae6143babb366dae8e20"
},
{
"url": "https://git.kernel.org/stable/c/ac562193c36696513ae196171892e9338475c4bc"
},
{
"url": "https://git.kernel.org/stable/c/3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5"
},
{
"url": "https://git.kernel.org/stable/c/a7a526fbc847f07ad3a503c7382189be5ab68574"
},
{
"url": "https://git.kernel.org/stable/c/b5bb2c696e140c399cb874def2feedf61dee27d6"
},
{
"url": "https://git.kernel.org/stable/c/076b1aa65f77a49bce5a48a4a55a397cfcafa2b8"
},
{
"url": "https://git.kernel.org/stable/c/39815715cbcfabb16fc8c5f4a23deeda20f5df62"
},
{
"url": "https://git.kernel.org/stable/c/8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2"
}
],
"title": "fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53402",
"datePublished": "2026-07-19T12:02:01.795Z",
"dateReserved": "2026-06-09T07:44:35.403Z",
"dateUpdated": "2026-07-24T14:34:03.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63815 (GCVE-0-2026-63815)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-24 14:34
VLAI
EPSS
VEX
Title
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
When the flexible_inline_xattr feature is enabled, do_read_inode() loads
the on-disk i_inline_xattr_size unconditionally:
if (f2fs_sb_has_flexible_inline_xattr(sbi))
fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
but sanity_check_inode() only range-checks it when the inode also has the
FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline
data but not FI_INLINE_XATTR -- the normal layout for an inline
directory -- therefore keeps a fully attacker-controlled
i_inline_xattr_size from a crafted image.
get_inline_xattr_addrs() returns that value with no flag gating, so it
feeds the inode geometry:
MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)
NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size
A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()
negative, so make_dentry_ptr_inline() sets d->max (int) to a negative
value. The inline directory walk then compares an unsigned long bit_pos
against that negative d->max, which is promoted to a huge unsigned bound,
and reads far past the inline area:
while (bit_pos < d->max) /* fs/f2fs/dir.c */
... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...
Mounting a crafted image and reading such a directory triggers an
out-of-bounds read in f2fs_fill_dentries(); the same underflow also
corrupts ADDRS_PER_INODE for regular files.
Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the
flexible_inline_xattr feature is enabled -- i.e. whenever the value is
loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE
bound gated on inodes that actually carry an inline xattr, so legitimate
inodes with i_inline_xattr_size == 0 are still accepted.
Severity
8.4 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6afc662e68b5f988282ff20afd58a89b1c279dca , < 3c8d6b4093aea40a20596f452289e7c22d84e6d5
(git)
Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < a08ee30dcbeff6b97df75c38c2589603ddde53a6 (git) Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < c3e05522daae4e7348a1ea81eeb321d25aa0fd3b (git) Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 76e1a05cf6d4051931d7fa4ead51a05786a62918 (git) Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706 (git) Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d (git) Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 16bc237ce3c483b75575abea53cfb639745311ed (git) Affected: 6afc662e68b5f988282ff20afd58a89b1c279dca , < 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 (git) |
|
| Linux | Linux |
Affected:
4.15
Unaffected: 0 , < 4.15 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c8d6b4093aea40a20596f452289e7c22d84e6d5",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "a08ee30dcbeff6b97df75c38c2589603ddde53a6",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "c3e05522daae4e7348a1ea81eeb321d25aa0fd3b",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "76e1a05cf6d4051931d7fa4ead51a05786a62918",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "16bc237ce3c483b75575abea53cfb639745311ed",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "378acf3cf19b6af6cba55e8dd1154c4e1504bae8",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n\nWhen the flexible_inline_xattr feature is enabled, do_read_inode() loads\nthe on-disk i_inline_xattr_size unconditionally:\n\n\tif (f2fs_sb_has_flexible_inline_xattr(sbi))\n\t\tfi-\u003ei_inline_xattr_size = le16_to_cpu(ri-\u003ei_inline_xattr_size);\n\nbut sanity_check_inode() only range-checks it when the inode also has the\nFI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline\ndata but not FI_INLINE_XATTR -- the normal layout for an inline\ndirectory -- therefore keeps a fully attacker-controlled\ni_inline_xattr_size from a crafted image.\n\nget_inline_xattr_addrs() returns that value with no flag gating, so it\nfeeds the inode geometry:\n\n\tMAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)\n\tNR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)\n\taddrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size\n\nA large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()\nnegative, so make_dentry_ptr_inline() sets d-\u003emax (int) to a negative\nvalue. The inline directory walk then compares an unsigned long bit_pos\nagainst that negative d-\u003emax, which is promoted to a huge unsigned bound,\nand reads far past the inline area:\n\n\twhile (bit_pos \u003c d-\u003emax)\t\t/* fs/f2fs/dir.c */\n\t\t... test_bit_le(bit_pos, d-\u003ebitmap) / d-\u003edentry[bit_pos] ...\n\nMounting a crafted image and reading such a directory triggers an\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also\ncorrupts ADDRS_PER_INODE for regular files.\n\nValidate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the\nflexible_inline_xattr feature is enabled -- i.e. whenever the value is\nloaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE\nbound gated on inodes that actually carry an inline xattr, so legitimate\ninodes with i_inline_xattr_size == 0 are still accepted."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:34:08.336Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c8d6b4093aea40a20596f452289e7c22d84e6d5"
},
{
"url": "https://git.kernel.org/stable/c/a08ee30dcbeff6b97df75c38c2589603ddde53a6"
},
{
"url": "https://git.kernel.org/stable/c/c3e05522daae4e7348a1ea81eeb321d25aa0fd3b"
},
{
"url": "https://git.kernel.org/stable/c/76e1a05cf6d4051931d7fa4ead51a05786a62918"
},
{
"url": "https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706"
},
{
"url": "https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d"
},
{
"url": "https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed"
},
{
"url": "https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8"
}
],
"title": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63815",
"datePublished": "2026-07-19T12:02:15.345Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-07-24T14:34:08.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63816 (GCVE-0-2026-63816)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-24 14:34
VLAI
EPSS
VEX
Title
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink
- f2fs_gc
- gc_data_segment
- ra_data_block(cow_inode)
- mapping = F2FS_I(inode)->atomic_inode->i_mapping
: f2fs_is_cow_file(cow_inode) is true
- f2fs_evict_inode(atomic_inode)
- clear_inode_flag(fi->cow_inode, FI_COW_FILE)
- F2FS_I(fi->cow_inode)->atomic_inode = NULL
...
- truncate_inode_pages_final(atomic_inode)
- f2fs_grab_cache_folio(mapping)
: create folio in atomic_inode->mapping
- clear_inode(atomic_inode)
- BUG_ON(atomic_inode->i_data.nrpages)
We need to add a reference on fi->atomic_inode before using its mapping
field during garbage collection, otherwise, it will cause UAF issue.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3db1de0e582c358dd013f3703cd55b5fe4076436 , < 7d3ae21783e5914c1761ac7d63f882d3d70800e9
(git)
Affected: 3db1de0e582c358dd013f3703cd55b5fe4076436 , < 56038756aae68312df00d4aa1d97e51ef3aca725 (git) Affected: 3db1de0e582c358dd013f3703cd55b5fe4076436 , < a499f77c06050a28c897bdbd86cd2f0721ae0743 (git) Affected: 3db1de0e582c358dd013f3703cd55b5fe4076436 , < a805fec35c201c59643ddcde713bce4051c8ee27 (git) Affected: 3db1de0e582c358dd013f3703cd55b5fe4076436 , < e0288584baa5dc41df4a829a023c4c1b33fe53d7 (git) Affected: 6db52f1944417c2601182a591a704e2f119c5215 (git) Affected: 5.18.18 , < 5.19 (semver) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c",
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d3ae21783e5914c1761ac7d63f882d3d70800e9",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "56038756aae68312df00d4aa1d97e51ef3aca725",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "a499f77c06050a28c897bdbd86cd2f0721ae0743",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "a805fec35c201c59643ddcde713bce4051c8ee27",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "e0288584baa5dc41df4a829a023c4c1b33fe53d7",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"status": "affected",
"version": "6db52f1944417c2601182a591a704e2f119c5215",
"versionType": "git"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.18",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c",
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode\n\n- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE)\t\t- shrink\n - f2fs_gc\n - gc_data_segment\n - ra_data_block(cow_inode)\n - mapping = F2FS_I(inode)-\u003eatomic_inode-\u003ei_mapping\n : f2fs_is_cow_file(cow_inode) is true\n\t\t\t\t\t\t - f2fs_evict_inode(atomic_inode)\n\t\t\t\t\t\t - clear_inode_flag(fi-\u003ecow_inode, FI_COW_FILE)\n\t\t\t\t\t\t - F2FS_I(fi-\u003ecow_inode)-\u003eatomic_inode = NULL\n\t\t\t\t\t\t ...\n\t\t\t\t\t\t - truncate_inode_pages_final(atomic_inode)\n - f2fs_grab_cache_folio(mapping)\n : create folio in atomic_inode-\u003emapping\n\t\t\t\t\t\t - clear_inode(atomic_inode)\n\t\t\t\t\t\t - BUG_ON(atomic_inode-\u003ei_data.nrpages)\n\nWe need to add a reference on fi-\u003eatomic_inode before using its mapping\nfield during garbage collection, otherwise, it will cause UAF issue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:34:09.322Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d3ae21783e5914c1761ac7d63f882d3d70800e9"
},
{
"url": "https://git.kernel.org/stable/c/56038756aae68312df00d4aa1d97e51ef3aca725"
},
{
"url": "https://git.kernel.org/stable/c/a499f77c06050a28c897bdbd86cd2f0721ae0743"
},
{
"url": "https://git.kernel.org/stable/c/a805fec35c201c59643ddcde713bce4051c8ee27"
},
{
"url": "https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7"
}
],
"title": "f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63816",
"datePublished": "2026-07-19T12:02:15.907Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-07-24T14:34:09.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63818 (GCVE-0-2026-63818)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-24 14:34
VLAI
EPSS
VEX
Title
f2fs: validate orphan inode entry count
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate orphan inode entry count
f2fs_recover_orphan_inodes() trusts the orphan block entry_count when
replaying orphan inodes from the checkpoint pack. A corrupted entry_count
larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the
ino[] array and interpret footer or following data as inode numbers.
On a crafted image, mounting an unpatched kernel can drive orphan recovery
into f2fs_bug_on() and panic the kernel. Validate entry_count before
consuming entries so corrupted checkpoint data fails the mount with
-EFSCORRUPTED and requests fsck instead.
Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be
recorded in the superblock s_errors[] field. This gives fsck a persistent
hint even though mount-time orphan recovery failure may leave no chance to
persist SBI_NEED_FSCK through a checkpoint.
Severity
8.4 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
127e670abfa7fa150f6550d620ded930f5bdb4e7 , < 210c210c92d78fdf5051bc55c5c69044b1a2150a
(git)
Affected: 127e670abfa7fa150f6550d620ded930f5bdb4e7 , < ad101d15716f5a24d1fa82a849f80430c805a3dd (git) Affected: 127e670abfa7fa150f6550d620ded930f5bdb4e7 , < d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70 (git) Affected: 127e670abfa7fa150f6550d620ded930f5bdb4e7 , < d2f236196d542ccd8505736e41c3a1d3f0305f6f (git) Affected: 127e670abfa7fa150f6550d620ded930f5bdb4e7 , < 550511a2470f6d204fa07b331f048bd2d3c51280 (git) Affected: 127e670abfa7fa150f6550d620ded930f5bdb4e7 , < 8aad54746c251f2c2370118df766c0c82e2d2091 (git) Affected: 127e670abfa7fa150f6550d620ded930f5bdb4e7 , < 2e12381d4495dc8b0ff042c6856022b2e359835c (git) Affected: 127e670abfa7fa150f6550d620ded930f5bdb4e7 , < 846c499a65816d13f1186e3090e825e8bb8bcb8b (git) |
|
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/checkpoint.c",
"include/linux/f2fs_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "210c210c92d78fdf5051bc55c5c69044b1a2150a",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "ad101d15716f5a24d1fa82a849f80430c805a3dd",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "d2f236196d542ccd8505736e41c3a1d3f0305f6f",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "550511a2470f6d204fa07b331f048bd2d3c51280",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "8aad54746c251f2c2370118df766c0c82e2d2091",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "2e12381d4495dc8b0ff042c6856022b2e359835c",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "846c499a65816d13f1186e3090e825e8bb8bcb8b",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/checkpoint.c",
"include/linux/f2fs_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate orphan inode entry count\n\nf2fs_recover_orphan_inodes() trusts the orphan block entry_count when\nreplaying orphan inodes from the checkpoint pack. A corrupted entry_count\nlarger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the\nino[] array and interpret footer or following data as inode numbers.\n\nOn a crafted image, mounting an unpatched kernel can drive orphan recovery\ninto f2fs_bug_on() and panic the kernel. Validate entry_count before\nconsuming entries so corrupted checkpoint data fails the mount with\n-EFSCORRUPTED and requests fsck instead.\n\nSet ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be\nrecorded in the superblock s_errors[] field. This gives fsck a persistent\nhint even though mount-time orphan recovery failure may leave no chance to\npersist SBI_NEED_FSCK through a checkpoint."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:34:11.320Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a"
},
{
"url": "https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd"
},
{
"url": "https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70"
},
{
"url": "https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f"
},
{
"url": "https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280"
},
{
"url": "https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091"
},
{
"url": "https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c"
},
{
"url": "https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b"
}
],
"title": "f2fs: validate orphan inode entry count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63818",
"datePublished": "2026-07-19T12:02:17.022Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-07-24T14:34:11.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…