{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T16:10:59.613631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:47:42.167Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:11.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8629a65a48890769c47ebc9b6e57c02a80a8975e",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            },
            {
              "lessThan": "cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            },
            {
              "lessThan": "826af9d2f69567c646ff46d10393d47e30ad23c6",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            },
            {
              "lessThan": "4d7b41c0e43995b0e992b9f8903109275744b658",
              "status": "affected",
              "version": "73ffa904b78287f6acf8797e040150aa26a4af4a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.32",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.11",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()\n\nExtend a critical section to prevent chan from early freeing.\nAlso make the l2cap_connect() return type void. Nothing is using the\nreturned value but it is ugly to return a potentially freed pointer.\nMaking it void will help with backports because earlier kernels did use\nthe return value. Now the compile will break for kernels where this\npatch is not a complete fix.\n\nCall stack summary:\n\n[use]\nl2cap_bredr_sig_cmd\n  l2cap_connect\n  \u250c mutex_lock(\u0026conn-\u003echan_lock);\n  \u2502 chan = pchan-\u003eops-\u003enew_connection(pchan); \u003c- alloc chan\n  \u2502 __l2cap_chan_add(conn, chan);\n  \u2502   l2cap_chan_hold(chan);\n  \u2502   list_add(\u0026chan-\u003elist, \u0026conn-\u003echan_l);   ... (1)\n  \u2514 mutex_unlock(\u0026conn-\u003echan_lock);\n    chan-\u003econf_state              ... (4) \u003c- use after free\n\n[free]\nl2cap_conn_del\n\u250c mutex_lock(\u0026conn-\u003echan_lock);\n\u2502 foreach chan in conn-\u003echan_l:            ... (2)\n\u2502   l2cap_chan_put(chan);\n\u2502     l2cap_chan_destroy\n\u2502       kfree(chan)               ... (3) \u003c- chan freed\n\u2514 mutex_unlock(\u0026conn-\u003echan_lock);\n\n==================================================================\nBUG: KASAN: slab-use-after-free in instrument_atomic_read\ninclude/linux/instrumented.h:68 [inline]\nBUG: KASAN: slab-use-after-free in _test_bit\ninclude/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0\nnet/bluetooth/l2cap_core.c:4260\nRead of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is the BR/EDR L2CAP signalling handler, reached by an attacker-sent L2CAP_CONN_REQ over an ACL link, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring guidance Bluetooth is Adjacent.\nAC:L - The attacker drives both sides of the race \u2014 it sends the L2CAP_CONN_REQ that allocates the channel and independently forces the link abort/disconnect that runs l2cap_conn_del on the other workqueue \u2014 and can repeat the attempt indefinitely at no cost. No precondition lies outside the attacker\u0027s control.\nPR:N - l2cap_bredr_sig_cmd() processes L2CAP_CONN_REQ on the fixed signalling CID 0x0001 with no authentication, and l2cap_connect() explicitly bypasses hci_conn_check_link_mode() for the always-listening SDP PSM 0x0001. An unpaired, unauthenticated remote device needs no credentials on the target.\nUI:N - Exploitation only requires the target to be connectable, which is the default state for phones, headsets, car head units, laptops and embedded devices with Bluetooth enabled. No victim action of any kind is needed.\nS:U - The corruption is of kernel slab memory handled by the kernel itself; the vulnerable component and the impacted component share the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed chan is read and its fields (imtu, max_tx, tx_win, fcs, retrans/monitor timeouts) are packed into an L2CAP Configuration Request sent back over the air, leaking reallocated slab contents directly to the attacker, and chan-\u003econn is dereferenced as a pointer taken from freed memory, giving an arbitrary-read primitive once the slab is groomed.\nI:H - After the free the code performs set_bit(CONF_REQ_SENT, \u0026chan-\u003econf_state) and chan-\u003enum_conf_req++, writing into the freed slab, and the object holds the ops function-pointer table and data/conn pointers, so heap spraying yields a write primitive and control-flow hijack potential.\nA:H - This is a slab use-after-free that reliably produces KASAN splats, memory corruption, and kernel oops/panic, and it can be re-triggered repeatedly by an unauthenticated in-range attacker to keep the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:36.021Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8629a65a48890769c47ebc9b6e57c02a80a8975e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36013",
    "datePublished": "2024-05-23T07:03:07.571Z",
    "dateReserved": "2024-05-17T13:50:33.153Z",
    "dateUpdated": "2026-08-05T11:31:36.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1645cd7fd42c236c952e9228badcac4fea1829ea",
              "status": "affected",
              "version": "0327ca9d53bfbb0918867313049bba7046900f73",
              "versionType": "git"
            },
            {
              "lessThan": "8985da5481562e96b95e94ed8e5cc9b6565eb82b",
              "status": "affected",
              "version": "0327ca9d53bfbb0918867313049bba7046900f73",
              "versionType": "git"
            },
            {
              "lessThan": "c99f66e4084a62a2cc401c4704a84328aeddc9ec",
              "status": "affected",
              "version": "0327ca9d53bfbb0918867313049bba7046900f73",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix queue freeze vs limits lock order in sysfs store methods\n\nqueue_attr_store() always freezes a device queue before calling the\nattribute store operation. For attributes that control queue limits, the\nstore operation will also lock the queue limits with a call to\nqueue_limits_start_update(). However, some drivers (e.g. SCSI sd) may\nneed to issue commands to a device to obtain limit values from the\nhardware with the queue limits locked. This creates a potential ABBA\ndeadlock situation if a user attempts to modify a limit (thus freezing\nthe device queue) while the device driver starts a revalidation of the\ndevice queue limits.\n\nAvoid such deadlock by not freezing the queue before calling the\n-\u003estore_limit() method in struct queue_sysfs_entry and instead use the\nqueue_limits_commit_update_frozen helper to freeze the queue after taking\nthe limits lock.\n\nThis also removes taking the sysfs lock for the store_limit method as\nit doesn\u0027t protect anything here, but creates even more nesting.\nHopefully it will go away from the actual sysfs methods entirely soon.\n\n(commit log adapted from a similar patch from  Damien Le Moal)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T15:00:42.201Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1645cd7fd42c236c952e9228badcac4fea1829ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/8985da5481562e96b95e94ed8e5cc9b6565eb82b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c99f66e4084a62a2cc401c4704a84328aeddc9ec"
        }
      ],
      "title": "block: fix queue freeze vs limits lock order in sysfs store methods",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21807",
    "datePublished": "2025-02-27T20:00:59.560Z",
    "dateReserved": "2024-12-29T08:45:45.772Z",
    "dateUpdated": "2026-07-18T15:00:42.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/quota/dquot.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8df2eedd371a1c24ecc4283581299d7737dfcd06",
              "status": "affected",
              "version": "3e6ff207cd5bd924ad94cd1a7c633bcdac0ba1cb",
              "versionType": "git"
            },
            {
              "lessThan": "f846eacde280ecc3daedfe001580e3033565179e",
              "status": "affected",
              "version": "bcacb52a985f1b6d280f698a470b873dfe52728a",
              "versionType": "git"
            },
            {
              "lessThan": "f12039df1515d5daf7d92e586ece5cefeb39561b",
              "status": "affected",
              "version": "8ea87e34792258825d290f4dc5216276e91cb224",
              "versionType": "git"
            },
            {
              "lessThan": "8a09a62f0c8c6123c2f1864ed6d5f9eb144afaf0",
              "status": "affected",
              "version": "ac6f420291b3fee1113f21d612fa88b628afab5b",
              "versionType": "git"
            },
            {
              "lessThan": "72b7ceca857f38a8ca7c5629feffc63769638974",
              "status": "affected",
              "version": "ac6f420291b3fee1113f21d612fa88b628afab5b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a5abba5e0e586e258ded3e798fe5f69c66fec198",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6f3821acd7c3143145999248087de5fb4b48cf26",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ab6cfcf8ed2c7496f55d020b65b1d8cd55d9a2cb",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.114",
              "status": "affected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.54",
              "status": "affected",
              "version": "6.12.4",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.174",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/quota/dquot.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.120",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "6.6.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "6.12.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.287",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.231",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.174",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: quota: create dedicated workqueue for quota_release_work\n\nThere is a kernel panic due to WARN_ONCE when panic_on_warn is set.\n\nThis issue occurs when writeback is triggered due to sync call for an\nopened file(ie, writeback reason is WB_REASON_SYNC). When f2fs balance\nis needed at sync path, flush for quota_release_work is triggered.\nBy default quota_release_work is queued to \"events_unbound\" queue which\ndoes not have WQ_MEM_RECLAIM flag. During f2fs balance \"writeback\"\nworkqueue tries to flush quota_release_work causing kernel panic due to\nMEM_RECLAIM flag mismatch errors.\n\nThis patch creates dedicated workqueue with WQ_MEM_RECLAIM flag\nfor work quota_release_work.\n\n------------[ cut here ]------------\nWARNING: CPU: 4 PID: 14867 at kernel/workqueue.c:3721 check_flush_dependency+0x13c/0x148\nCall trace:\n check_flush_dependency+0x13c/0x148\n __flush_work+0xd0/0x398\n flush_delayed_work+0x44/0x5c\n dquot_writeback_dquots+0x54/0x318\n f2fs_do_quota_sync+0xb8/0x1a8\n f2fs_write_checkpoint+0x3cc/0x99c\n f2fs_gc+0x190/0x750\n f2fs_balance_fs+0x110/0x168\n f2fs_write_single_data_page+0x474/0x7dc\n f2fs_write_data_pages+0x7d0/0xd0c\n do_writepages+0xe0/0x2f4\n __writeback_single_inode+0x44/0x4ac\n writeback_sb_inodes+0x30c/0x538\n wb_writeback+0xf4/0x440\n wb_workfn+0x128/0x5d4\n process_scheduled_works+0x1c4/0x45c\n worker_thread+0x32c/0x3e8\n kthread+0x11c/0x1b0\n ret_from_fork+0x10/0x20\nKernel panic - not syncing: kernel: panic_on_warn set ..."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:26.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8df2eedd371a1c24ecc4283581299d7737dfcd06"
        },
        {
          "url": "https://git.kernel.org/stable/c/f846eacde280ecc3daedfe001580e3033565179e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f12039df1515d5daf7d92e586ece5cefeb39561b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a09a62f0c8c6123c2f1864ed6d5f9eb144afaf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/72b7ceca857f38a8ca7c5629feffc63769638974"
        }
      ],
      "title": "fs: quota: create dedicated workqueue for quota_release_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40196",
    "datePublished": "2025-11-12T21:56:32.578Z",
    "dateReserved": "2025-04-16T07:20:57.178Z",
    "dateUpdated": "2026-07-24T14:33:26.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae9cdb29efed20ffdee9ff3b0bb72fb369c353da",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            },
            {
              "lessThan": "bd4a7fb04f06f419b0e93d8b52fe32067eb312d1",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            },
            {
              "lessThan": "745a535461bbb90a56d9357573c9f97a5c12abe1",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            },
            {
              "lessThan": "dd577cb55588ec3fbc66af3621280306601c4192",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            },
            {
              "lessThan": "dd53414e301beb915fe672dc4c4a51bafb917604",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            },
            {
              "lessThan": "269c800a7a7e363459291885b35f7bc72e231ed6",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            },
            {
              "lessThan": "6c8c44e6553b9f072f62d9875e567766eb293162",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            },
            {
              "lessThan": "ad0057fb91218914d6c98268718ceb9d59b388e1",
              "status": "affected",
              "version": "fad4161b5cd01a24202234976ebbb133f7adc0b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix mechToken leak when SPNEGO decode fails after token alloc\n\nThe kernel ASN.1 BER decoder calls action callbacks incrementally as it\nwalks the input.  When ksmbd_decode_negTokenInit() reaches the mechToken\n[2] OCTET STRING element, ksmbd_neg_token_alloc() allocates\nconn-\u003emechToken immediately via kmemdup_nul().  If a later element in\nthe same blob is malformed, then the decoder will return nonzero after\nthe allocation is already live.  This could happen if mechListMIC [3]\noverrunse the enclosing SEQUENCE.\n\ndecode_negotiation_token() then sets conn-\u003euse_spnego = false because\nboth the negTokenInit and negTokenTarg grammars failed.  The cleanup at\nthe bottom of smb2_sess_setup() is gated on use_spnego:\n\n\tif (conn-\u003euse_spnego \u0026\u0026 conn-\u003emechToken) {\n\t\tkfree(conn-\u003emechToken);\n\t\tconn-\u003emechToken = NULL;\n\t}\n\nso the kfree is skipped, causing the mechToken to never be freed.\n\nThis codepath is reachable pre-authentication, so untrusted clients can\ncause slow memory leaks on a server without even being properly\nauthenticated.\n\nFix this up by not checking check for use_spnego, as it\u0027s not required,\nso the memory will always be properly freed.  At the same time, always\nfree the memory in ksmbd_conn_free() incase some other failure path\nforgot to free it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:31.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae9cdb29efed20ffdee9ff3b0bb72fb369c353da"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd4a7fb04f06f419b0e93d8b52fe32067eb312d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd577cb55588ec3fbc66af3621280306601c4192"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604"
        },
        {
          "url": "https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1"
        }
      ],
      "title": "ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31610",
    "datePublished": "2026-04-24T14:42:31.471Z",
    "dateReserved": "2026-03-09T15:48:24.122Z",
    "dateUpdated": "2026-07-24T14:33:31.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sock.h",
            "net/core/skbuff.c",
            "net/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4839cbda8f13e99ce2bb3b593f5cc3288415684b",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            },
            {
              "lessThan": "3709d73ace37e9aaebb688f5a5cf706d74350b64",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            },
            {
              "lessThan": "cf7599116c4c0082fd25cb1bf0254631da0ed06e",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            },
            {
              "lessThan": "cd2463ec60f0d6e460078037c86f9d0947ee1ff6",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            },
            {
              "lessThan": "c770217044d9cbe16a1f7c385cf080ed06a2fc04",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            },
            {
              "lessThan": "f3e4cceafad27c9363c33622732f86722846ec6f",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            },
            {
              "lessThan": "e4c6efb3b70ff87f1df99efce2f8893717695718",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            },
            {
              "lessThan": "983512f3a87fd8dc4c94dfa6b596b6e57df5aad7",
              "status": "affected",
              "version": "b245be1f4db1a0394e4b6eb66059814b46670ac3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sock.h",
            "net/core/skbuff.c",
            "net/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Drop the lock in skb_may_tx_timestamp()\n\nskb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must\nnot be taken in IRQ context, only softirq is okay. A few drivers receive\nthe timestamp via a dedicated interrupt and complete the TX timestamp\nfrom that handler. This will lead to a deadlock if the lock is already\nwrite-locked on the same CPU.\n\nTaking the lock can be avoided. The socket (pointed by the skb) will\nremain valid until the skb is released. The -\u003esk_socket and -\u003efile\nmember will be set to NULL once the user closes the socket which may\nhappen before the timestamp arrives.\nIf we happen to observe the pointer while the socket is closing but\nbefore the pointer is set to NULL then we may use it because both\npointer (and the file\u0027s cred member) are RCU freed.\n\nDrop the lock. Use READ_ONCE() to obtain the individual pointer. Add a\nmatching WRITE_ONCE() where the pointer are cleared."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:35.358Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4839cbda8f13e99ce2bb3b593f5cc3288415684b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3709d73ace37e9aaebb688f5a5cf706d74350b64"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf7599116c4c0082fd25cb1bf0254631da0ed06e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd2463ec60f0d6e460078037c86f9d0947ee1ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c770217044d9cbe16a1f7c385cf080ed06a2fc04"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3e4cceafad27c9363c33622732f86722846ec6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4c6efb3b70ff87f1df99efce2f8893717695718"
        },
        {
          "url": "https://git.kernel.org/stable/c/983512f3a87fd8dc4c94dfa6b596b6e57df5aad7"
        }
      ],
      "title": "net: Drop the lock in skb_may_tx_timestamp()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43216",
    "datePublished": "2026-05-06T11:28:18.277Z",
    "dateReserved": "2026-05-01T14:12:55.993Z",
    "dateUpdated": "2026-07-24T14:33:35.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c716a59e9977d751e5eb54bcfa6a80124cb5067b",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            },
            {
              "lessThan": "d2138abc8f0a7fce4101b7229b43b06811ed083d",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            },
            {
              "lessThan": "a922dbafb4a674d958d702038232d09a30daf770",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            },
            {
              "lessThan": "c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2",
              "status": "affected",
              "version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c",
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/pasid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down context entry\n\nWhen tearing down a context entry, the current implementation zeros the\nentire 128-bit entry using multiple 64-bit writes. This creates a window\nwhere the hardware can fetch a \"torn\" entry \u2014 where some fields are\nalready zeroed while the \u0027Present\u0027 bit is still set \u2014 leading to\nunpredictable behavior or spurious faults.\n\nWhile x86 provides strong write ordering, the compiler may reorder writes\nto the two 64-bit halves of the context entry. Even without compiler\nreordering, the hardware fetch is not guaranteed to be atomic with\nrespect to multiple CPU writes.\n\nAlign with the \"Guidance to Software for Invalidations\" in the VT-d spec\n(Section 6.5.3.3) by implementing the recommended ownership handshake:\n\n1. Clear only the \u0027Present\u0027 (P) bit of the context entry first to\n   signal the transition of ownership from hardware to software.\n2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.\n3. Perform the required cache and context-cache invalidation to ensure\n   hardware no longer has cached references to the entry.\n4. Fully zero out the entry only after the invalidation is complete.\n\nAlso, add a dma_wmb() to context_set_present() to ensure the entry\nis fully initialized before the \u0027Present\u0027 bit becomes visible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable setup/teardown paths are reached via local IOMMU domain management (VFIO/iommufd device assignment or sysfs driver bind/unbind); there is no network or adjacent-network path to this code.\nAC:H - Manifesting the torn-entry requires the IOMMU hardware to fetch the context entry in a microscopic window between the CPU writes and the cache/context-cache invalidation, combined with compiler/CPU write reordering \u2014 timing conditions the attacker cannot reliably control.\nPR:H - Driving an IOMMU context setup/teardown requires CAP_SYS_ADMIN-level privilege (VFIO/iommufd assignment or sysfs driver unbind), which is not obtainable through user namespaces.\nUI:N - The teardown/setup window is reached purely through IOMMU control operations with no victim action required.\nS:C - The IOMMU is the DMA isolation boundary; a torn/stale context entry lets a device\u0027s in-flight DMA be mistranslated and escape its assigned domain, impacting memory belonging to a different security authority (the host or another domain).\nC:H - A device using a stale/torn translation during the window can read host memory outside its intended domain across the IOMMU boundary, yielding a potential arbitrary device-driven read.\nI:H - The same cross-boundary mistranslation lets the device write host memory outside its domain, providing an arbitrary device-driven write primitive.\nA:H - The commit documents \"unpredictable behavior or spurious faults\"; torn-entry fetches generate DMAR fault storms and device/driver malfunction that can hang or crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:51.029Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c716a59e9977d751e5eb54bcfa6a80124cb5067b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2138abc8f0a7fce4101b7229b43b06811ed083d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a922dbafb4a674d958d702038232d09a30daf770"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2"
        }
      ],
      "title": "iommu/vt-d: Clear Present bit before tearing down context entry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45944",
    "datePublished": "2026-05-27T12:18:00.481Z",
    "dateReserved": "2026-05-13T15:03:33.087Z",
    "dateUpdated": "2026-08-05T12:28:51.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c15ff206ba78820bf2873d0c668a882e99f4b631",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "687ccdf582169cd680aeaf24cc953807c4cd4345",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "12f2341b4c235d5593a433abac201c1c6725787f",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "ec05f51f1e65bce95528543eb73fda56fd201d94",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: take vmap_purge_lock in shrinker\n\ndecay_va_pool_node() can be invoked concurrently from two paths:\n__purge_vmap_area_lazy() when pools are being purged, and the shrinker via\nvmap_node_shrink_scan().\n\nHowever, decay_va_pool_node() is not safe to run concurrently, and the\nshrinker path currently lacks serialization, leading to races and possible\nleaks.\n\nProtect decay_va_pool_node() by taking vmap_purge_lock in the shrinker\npath to ensure serialization with purge users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable race is in core MM internals (vmap pool decay) reached only via local memory-management activity \u2014 inducing vmalloc/vfree churn (purge path) and memory pressure (shrinker path). No network-delivered data reaches the vulnerable function.\nAC:L - An unprivileged attacker controls both sides: one thread forces direct reclaim (shrinker\u2192decay) while another drives vmalloc/vfree churn past the lazy-free threshold (purge\u2192decay), and both can loop indefinitely to repeatedly attempt and win the narrow race.\nPR:L - Any unprivileged local process can allocate/free memory and induce reclaim; no capabilities or root are required to drive either racing path.\nUI:N - The race is triggered entirely by the attacker\u0027s own memory activity; no victim action is needed.\nS:U - The corruption stays within the kernel\u0027s own memory-management structures and does not cross into another security authority (no VM/IOMMU boundary escape).\nC:H - The data race corrupts the vmap pool linked list and free-area tree metadata; per kernel guidance, allocator memory corruption can be leveraged to read freed/adjacent kernel memory.\nI:H - Concurrent unserialized list_replace_init plus double-merge of vmap_area objects into the global free tree corrupts kernel free-list/tree state, a write/corruption primitive over allocator metadata.\nA:H - Corrupted lists and inconsistent len accounting (and the documented leaks) cause kernel crashes/oops and resource exhaustion when the corrupted pool is subsequently traversed or reused."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:35.424Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c15ff206ba78820bf2873d0c668a882e99f4b631"
        },
        {
          "url": "https://git.kernel.org/stable/c/687ccdf582169cd680aeaf24cc953807c4cd4345"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f2341b4c235d5593a433abac201c1c6725787f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec05f51f1e65bce95528543eb73fda56fd201d94"
        }
      ],
      "title": "mm/vmalloc: take vmap_purge_lock in shrinker",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46093",
    "datePublished": "2026-05-27T12:58:43.458Z",
    "dateReserved": "2026-05-13T15:03:33.097Z",
    "dateUpdated": "2026-08-05T12:29:35.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7dd4d27aa70bd98bb10572310e913668baf6a65",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "6f96dea4819d122737b217ea16660d255abbf8c6",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "5f0b95ef68ab9afba75b20eebf436130f80c161a",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "dcfe4d1f7960e7d1c01642318f3aae1a604f8508",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            },
            {
              "lessThan": "5293a8882c549fab4a878bc76b0b6c951f980a61",
              "status": "affected",
              "version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix race between ICReq handling and queue teardown\n\nnvmet_tcp_handle_icreq() updates queue-\u003estate after sending an\nInitialization Connection Response (ICResp), but it does so without\nserializing against target-side queue teardown.\n\nIf an NVMe/TCP host sends an Initialization Connection Request\n(ICReq) and immediately closes the connection, target-side teardown\nmay start in softirq context before io_work drains the already\nbuffered ICReq. In that case, nvmet_tcp_schedule_release_queue()\nsets queue-\u003estate to NVMET_TCP_Q_DISCONNECTING and drops the queue\nreference under state_lock.\n\nIf io_work later processes that ICReq, nvmet_tcp_handle_icreq() can\nstill overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the\nDISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and\nallows a later socket state change to re-enter teardown and issue a\nsecond kref_put() on an already released queue.\n\nThe ICResp send failure path has the same problem. If teardown has\nalready moved the queue to DISCONNECTING, a send error can still\noverwrite the state with NVMET_TCP_Q_FAILED, again reopening the\nwindow for a second teardown path to drop the queue reference.\n\nFix this by serializing both post-send state transitions with\nstate_lock and bailing out if teardown has already started.\n\nUse -ESHUTDOWN as an internal sentinel for that bail-out path rather\nthan propagating it as a transport error like -ECONNRESET. Keep\nnvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before\nhonoring that sentinel so receive-side parsing stays quiesced until the\nexisting release path completes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the NVMe-over-TCP target driver, which processes PDUs from remote network peers on a listening TCP port (default 4420); the race is triggered by sending an ICReq and closing the connection \u2014 purely remote network operations.\nAC:L - The attacker controls both sides of the race (sends the ICReq, then immediately closes the connection) and can open unlimited connections to reliably win the timing window between softirq teardown and io_work processing, so success does not depend on conditions beyond the attacker\u0027s control.\nPR:N - The ICReq is the first PDU of the NVMe/TCP connection handshake and is handled entirely pre-authentication; an unauthenticated remote attacker need only connect and send an ICReq, with no credentials required in the default non-TLS configuration.\nUI:N - The attacker initiates the connection and triggers the race entirely on their own; no action from any local user or victim is required.\nS:U - The corruption is confined to the kernel\u0027s own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The double kref_put produces a use-after-free of the queue object, and per kernel UAF guidance this gives the attacker control over freed object contents, enabling arbitrary kernel memory disclosure.\nI:H - The use-after-free / double-free enables heap spraying to reclaim the freed allocation, providing a write primitive and potential control-flow hijack, so integrity impact is high.\nA:H - The refcount underflow and resulting use-after-free reliably cause kernel oops/panic, taking down the target system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:58.184Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7dd4d27aa70bd98bb10572310e913668baf6a65"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c63cf80895a70eb4fcfcaa725bb1ac9ae76f02b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f96dea4819d122737b217ea16660d255abbf8c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f0b95ef68ab9afba75b20eebf436130f80c161a"
        },
        {
          "url": "https://git.kernel.org/stable/c/49891c8fe0cb43fbbe480da1cdccfbbaeb820cb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/67e1aaf93b495c2f10bc8a5fbba575fbb7f449b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcfe4d1f7960e7d1c01642318f3aae1a604f8508"
        },
        {
          "url": "https://git.kernel.org/stable/c/5293a8882c549fab4a878bc76b0b6c951f980a61"
        }
      ],
      "title": "nvmet-tcp: fix race between ICReq handling and queue teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46135",
    "datePublished": "2026-05-28T09:35:49.828Z",
    "dateReserved": "2026-05-13T15:03:33.099Z",
    "dateUpdated": "2026-08-05T12:29:58.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48c41cd2e04af4b2cdef19e2d00994ae82952f14",
              "status": "affected",
              "version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
              "versionType": "git"
            },
            {
              "lessThan": "e0a71cbf0c1906a2eccbe69dd7d7f36fd1511d66",
              "status": "affected",
              "version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
              "versionType": "git"
            },
            {
              "lessThan": "b34a1d83c74a124c968b5adb25c809db3e2eb86a",
              "status": "affected",
              "version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
              "versionType": "git"
            },
            {
              "lessThan": "965dc93481d1b80d341bdd16c27b16fe197175ee",
              "status": "affected",
              "version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Drop all SCM attributes for SOCKMAP.\n\nSOCKMAP can hide inflight fd from AF_UNIX GC.\n\nWhen a socket in SOCKMAP receives skb with inflight fd,\nsk_psock_verdict_data_ready() looks up the mapped socket and\nenqueue skb to its psock-\u003eingress_skb.\n\nSince neither the old nor the new GC can inspect the psock\nqueue, the hidden skb leaks the inflight sockets.  Note that\nthis cannot be detected via kmemleak because inflight sockets\nare linked to a global list.\n\nIn addition, SOCKMAP redirect breaks the Tarjan-based GC\u0027s\nassumption that unix_edge.successor is always alive, which\nis no longer true once skb is redirected, resulting in\nuse-after-free below. [0]\n\nMoreover, SOCKMAP does not call scm_stat_del() properly,\nso unix_show_fdinfo() could report an incorrect fd count.\n\nsk_msg_recvmsg() does not support any SCM attributes in the\nfirst place.\n\nLet\u0027s drop all SCM attributes before passing skb to the\nSOCKMAP layer.\n\n[0]:\nBUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)\nRead of size 8 at addr ffff888125362670 by task kworker/56:1/496\n\nCPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nWorkqueue: events sk_psock_backlog\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:122)\n print_report (mm/kasan/report.c:379)\n kasan_report (mm/kasan/report.c:597)\n unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)\n unix_destroy_fpl (net/unix/garbage.c:317)\n unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976)\n sk_psock_backlog (./include/linux/skbuff.h:?)\n process_scheduled_works (kernel/workqueue.c:?)\n worker_thread (kernel/workqueue.c:?)\n kthread (kernel/kthread.c:438)\n ret_from_fork (arch/x86/kernel/process.c:164)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:258)\n \u003c/TASK\u003e\n\nAllocated by task 955:\n kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)\n __kasan_slab_alloc (mm/kasan/common.c:369)\n kmem_cache_alloc_noprof (mm/slub.c:4539)\n sk_prot_alloc (net/core/sock.c:2240)\n sk_alloc (net/core/sock.c:2301)\n unix_create1 (net/unix/af_unix.c:1099)\n unix_create (net/unix/af_unix.c:1169)\n __sock_create (net/socket.c:1606)\n __sys_socketpair (net/socket.c:1811)\n __x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860)\n do_syscall_64 (arch/x86/entry/syscall_64.c:?)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nFreed by task 496:\n kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)\n kasan_save_free_info (mm/kasan/generic.c:587)\n __kasan_slab_free (mm/kasan/common.c:287)\n kmem_cache_free (mm/slub.c:6165)\n __sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384)\n sk_psock_destroy (./include/net/sock.h:?)\n process_scheduled_works (kernel/workqueue.c:?)\n worker_thread (kernel/workqueue.c:?)\n kthread (kernel/kthread.c:438)\n ret_from_fork (arch/x86/kernel/process.c:164)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:258)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable AF_UNIX SOCKMAP path is reached through local syscalls such as bpf(), socketpair(), map update/attach, and sendmsg() with SCM_RIGHTS; remote network peers cannot pass AF_UNIX file descriptors into this path.\nAC:L - The attacker can create the sockets, install the SOCKMAP verdict redirect, send SCM_RIGHTS, and close/tear down the involved sockets; any timing involved is under attacker control.\nPR:L - Triggering requires creating/attaching SK_SKB SOCKMAP BPF objects, gated by CAP_BPF/CAP_NET_ADMIN or delegated BPF token access. In a reasonable namespaced/delegated BPF deployment this is low privilege rather than host-root-only.\nUI:N - No victim action is required after the attacker has local access and the needed BPF privileges; the trigger is entirely attacker-driven.\nS:U - The vulnerability is in the host kernel AF_UNIX/SOCKMAP implementation and impacts the same kernel security authority. This is standard kernel memory corruption/DoS rather than a hypervisor or device isolation boundary escape.\nC:H - The bug produces a use-after-free on AF_UNIX socket/SCM graph state after SOCKMAP hides redirected skb SCM attributes. Per kernel scoring guidance, UAF memory corruption is treated as capable of high confidentiality impact.\nI:H - The freed socket/graph state can be reused while kernel GC follows stale pointers, making this memory corruption potentially exploitable beyond a simple crash. Per guidance, UAF is scored as high integrity impact.\nA:H - The reported failure is a KASAN slab-use-after-free in AF_UNIX GC/workqueue processing, and the hidden inflight-fd skb state can also leak socket references. This can cause kernel oops/panic or sustained resource exhaustion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:34.349Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48c41cd2e04af4b2cdef19e2d00994ae82952f14"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0a71cbf0c1906a2eccbe69dd7d7f36fd1511d66"
        },
        {
          "url": "https://git.kernel.org/stable/c/b34a1d83c74a124c968b5adb25c809db3e2eb86a"
        },
        {
          "url": "https://git.kernel.org/stable/c/965dc93481d1b80d341bdd16c27b16fe197175ee"
        }
      ],
      "title": "af_unix: Drop all SCM attributes for SOCKMAP.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53005",
    "datePublished": "2026-06-24T16:29:16.901Z",
    "dateReserved": "2026-06-09T07:44:35.377Z",
    "dateUpdated": "2026-08-05T12:32:34.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea59d9dbc5504e29d420ac4aab774cbce39b0e69",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "d68a14450783ecc5fddae957ac4e1c546dfcfb73",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "d7ea8495fd307b58f8867acd81a1b40075b1d3ba",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "406a037d93b769bca248476bd14bbe548dc1ec35",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.132",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.132",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()\n\nWhen a compressed or sparse attribute has its clusters frame-aligned,\nvcn is rounded down to the frame start using cmask, which can result\nin vcn != vcn0. In this case, vcn and vcn0 may reside in different\nattribute segments.\n\nThe code already handles the case where vcn is in a different segment\nby loading its runs before allocation. However, it fails to load runs\nfor vcn0 when vcn0 resides in a different segment than vcn. This causes\nrun_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was\nnever loaded into the in-memory run list, triggering the WARN_ON(1).\n\nFix this by adding a missing check for vcn0 after the existing vcn\nsegment check. If vcn0 falls outside the current segment range\n[svcn, evcn1), find and load the attribute segment containing vcn0\nbefore performing the run lookup.\n\nThe following scenario triggers the bug:\n  attr_data_get_block_locked()\n    vcn = vcn0 \u0026 cmask        \u003c- vcn != vcn0 after frame alignment\n    load runs for vcn segment \u003c- vcn0 segment not loaded!\n    attr_allocate_clusters()  \u003c- allocation succeeds\n    run_lookup_entry(vcn0)    \u003c- vcn0 not in run -\u003e SPARSE_LCN\n    WARN_ON(1)                \u003c- bug fires here!"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:47.674Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69"
        },
        {
          "url": "https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba"
        }
      ],
      "title": "fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53027",
    "datePublished": "2026-06-24T16:29:35.740Z",
    "dateReserved": "2026-06-09T07:44:35.379Z",
    "dateUpdated": "2026-07-24T14:33:47.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}