Vulnerability-Lookup

RHSA-2025:22910

Vulnerability from csaf_opensuse - Published: 2025-12-09 00:00 - Updated: 2026-09-20 11:51

Summary

security update for kernel

Severity

Moderate

Notes

Title of the patch: security update for kernel

Description of the patch: This security update provides a functional equivalent of RHSA-2025:22910. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2025:22910.

Patchnames: RHSA-2025:22910

CVE-2022-3640

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 13 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2022-50341

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 13 products, the same list as for CVE-2022-3640

Threats

Impact moderate

CVE-2022-50386

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 13 products, the same list as for CVE-2022-3640

Threats

Impact important

CVE-2022-50408

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 13 products, the same list as for CVE-2022-3640

Threats

Impact important

CVE-2023-53305

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 13 products, the same list as for CVE-2022-3640

Threats

Impact moderate

CVE-2023-53365

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 13 products, the same list as for CVE-2022-3640

Threats

Impact moderate

CVE-2025-38718

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 13 products, the same list as for CVE-2022-3640

Threats

Impact moderate

References

31 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2022-3640/	self
https://www.suse.com/security/cve/CVE-2022-50341/	self
https://www.suse.com/security/cve/CVE-2022-50386/	self
https://www.suse.com/security/cve/CVE-2022-50408/	self
https://www.suse.com/security/cve/CVE-2023-53305/	self
https://www.suse.com/security/cve/CVE-2023-53365/	self
https://www.suse.com/security/cve/CVE-2025-38718/	self
https://www.suse.com/security/cve/CVE-2022-3640	external
https://bugzilla.suse.com/1204619	external
https://bugzilla.suse.com/1204624	external
https://bugzilla.suse.com/1209225	external
https://www.suse.com/security/cve/CVE-2022-50341	external
https://www.suse.com/security/cve/CVE-2022-50386	external
https://bugzilla.suse.com/1247374	external
https://bugzilla.suse.com/1250301	external
https://bugzilla.suse.com/1250302	external
https://bugzilla.suse.com/1253291	external
https://bugzilla.suse.com/1253292	external
https://www.suse.com/security/cve/CVE-2022-50408	external
https://bugzilla.suse.com/1250391	external
https://bugzilla.suse.com/1250419	external
https://www.suse.com/security/cve/CVE-2023-53305	external
https://bugzilla.suse.com/1250049	external
https://www.suse.com/security/cve/CVE-2023-53365	external
https://bugzilla.suse.com/1249988	external
https://www.suse.com/security/cve/CVE-2025-38718	external
https://bugzilla.suse.com/1249161	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2025:22910.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2025:22910.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2025:22910",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_22910.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2025:22910",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-January/002362.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2025:22910",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-January/002362.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3640 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3640/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-50341 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-50341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-50386 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-50386/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-50408 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-50408/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-53305 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-53305/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-53365 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-53365/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-38718 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-38718/"
      }
    ],
    "title": "security update for kernel",
    "tracking": {
      "current_release_date": "2026-09-20T11:51:53Z",
      "generator": {
        "date": "2025-12-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2025:22910",
      "initial_release_date": "2025-12-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-12-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:51:53Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
                "product": {
                  "name": "kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
                  "product_id": "kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-abi-whitelists@3.10.0-1160.143.1.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
                "product": {
                  "name": "kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
                  "product_id": "kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-doc@3.10.0-1160.143.1.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bpftool-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "bpftool-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "bpftool-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bpftool@3.10.0-1160.143.1.el7?arch=x86_64\u0026upstream=bpftool-0:3.10.0-1160.143.1.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel@3.10.0-1160.143.1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:3.10.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug@3.10.0-1160.143.1.el7?arch=x86_64\u0026upstream=kernel-debug-0:3.10.0-1160.143.1.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:3.10.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug-devel@3.10.0-1160.143.1.el7?arch=x86_64\u0026upstream=kernel-debug-0:3.10.0-1160.143.1.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:3.10.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@3.10.0-1160.143.1.el7?arch=x86_64\u0026upstream=kernel-source-0:3.10.0-1160.143.1.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-headers@3.10.0-1160.143.1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools@3.10.0-1160.143.1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs@3.10.0-1160.143.1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs-devel@3.10.0-1160.143.1.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perf-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "perf-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "perf-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perf@3.10.0-1160.143.1.el7?arch=x86_64\u0026upstream=perf-0:3.10.0-1160.143.1.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-perf-0:3.10.0-1160.143.1.el7.x86_64",
                "product": {
                  "name": "python-perf-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_id": "python-perf-0:3.10.0-1160.143.1.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python-perf@3.10.0-1160.143.1.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7 LTSS",
                "product": {
                  "name": "SUSE Liberty Linux 7 LTSS",
                  "product_id": "SUSE Liberty Linux 7 LTSS"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bpftool-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "bpftool-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch"
        },
        "product_reference": "kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-doc-0:3.10.0-1160.143.1.el7.noarch as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch"
        },
        "product_reference": "kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-headers-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perf-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "perf-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-perf-0:3.10.0-1160.143.1.el7.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        },
        "product_reference": "python-perf-0:3.10.0-1160.143.1.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-3640",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3640"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3640",
          "url": "https://www.suse.com/security/cve/CVE-2022-3640"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204619 for CVE-2022-3640",
          "url": "https://bugzilla.suse.com/1204619"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204624 for CVE-2022-3640",
          "url": "https://bugzilla.suse.com/1204624"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209225 for CVE-2022-3640",
          "url": "https://bugzilla.suse.com/1209225"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3640"
    },
    {
      "cve": "CVE-2022-50341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-50341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix oops during encryption\n\nWhen running xfstests against Azure the following oops occurred on an\narm64 system\n\n  Unable to handle kernel write to read-only memory at virtual address\n  ffff0001221cf000\n  Mem abort info:\n    ESR = 0x9600004f\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x0f: level 3 permission fault\n  Data abort info:\n    ISV = 0, ISS = 0x0000004f\n    CM = 0, WnR = 1\n  swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000\n  [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003,\n  pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787\n  Internal error: Oops: 9600004f [#1] PREEMPT SMP\n  ...\n  pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)\n  pc : __memcpy+0x40/0x230\n  lr : scatterwalk_copychunks+0xe0/0x200\n  sp : ffff800014e92de0\n  x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008\n  x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008\n  x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000\n  x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014\n  x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058\n  x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590\n  x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580\n  x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005\n  x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001\n  x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000\n  Call trace:\n   __memcpy+0x40/0x230\n   scatterwalk_map_and_copy+0x98/0x100\n   crypto_ccm_encrypt+0x150/0x180\n   crypto_aead_encrypt+0x2c/0x40\n   crypt_message+0x750/0x880\n   smb3_init_transform_rq+0x298/0x340\n   smb_send_rqst.part.11+0xd8/0x180\n   smb_send_rqst+0x3c/0x100\n   compound_send_recv+0x534/0xbc0\n   smb2_query_info_compound+0x32c/0x440\n   smb2_set_ea+0x438/0x4c0\n   cifs_xattr_set+0x5d4/0x7c0\n\nThis is because in scatterwalk_copychunks(), we attempted to write to\na buffer (@sign) that was allocated in the stack (vmalloc area) by\ncrypt_message() and thus accessing its remaining 8 (x2) bytes ended up\ncrossing a page boundary.\n\nTo simply fix it, we could just pass @sign kmalloc\u0027d from\ncrypt_message() and then we\u0027re done.  Luckily, we don\u0027t seem to pass\nany other vmalloc\u0027d buffers in smb_rqst::rq_iov...\n\nInstead, let\u0027s map the correct pages and offsets from vmalloc buffers\nas well in cifs_sg_set_buf() and then avoiding such oopses.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-50341",
          "url": "https://www.suse.com/security/cve/CVE-2022-50341"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-50341"
    },
    {
      "cve": "CVE-2022-50386",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-50386"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix user-after-free\n\nThis uses l2cap_chan_hold_unless_zero() after calling\n__l2cap_get_chan_blah() to prevent the following trace:\n\nBluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref\n*kref)\nBluetooth: chan 0000000023c4974d\nBluetooth: parent 00000000ae861c08\n==================================================================\nBUG: KASAN: use-after-free in __mutex_waiter_is_first\nkernel/locking/mutex.c:191 [inline]\nBUG: KASAN: use-after-free in __mutex_lock_common\nkernel/locking/mutex.c:671 [inline]\nBUG: KASAN: use-after-free in __mutex_lock+0x278/0x400\nkernel/locking/mutex.c:729\nRead of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-50386",
          "url": "https://www.suse.com/security/cve/CVE-2022-50386"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1247374 for CVE-2022-50386",
          "url": "https://bugzilla.suse.com/1247374"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250301 for CVE-2022-50386",
          "url": "https://bugzilla.suse.com/1250301"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250302 for CVE-2022-50386",
          "url": "https://bugzilla.suse.com/1250302"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253291 for CVE-2022-50386",
          "url": "https://bugzilla.suse.com/1253291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253292 for CVE-2022-50386",
          "url": "https://bugzilla.suse.com/1253292"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-50386"
    },
    {
      "cve": "CVE-2022-50408",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-50408"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()\n\n\u003e ret = brcmf_proto_tx_queue_data(drvr, ifp-\u003eifidx, skb);\n\nmay be schedule, and then complete before the line\n\n\u003e ndev-\u003estats.tx_bytes += skb-\u003elen;\n\n[   46.912801] ==================================================================\n[   46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328\n[   46.935991]\n[   46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G           O      5.4.199-[REDACTED] #1\n[   46.947255] Hardware name: [REDACTED]\n[   46.954568] Call trace:\n[   46.957037]  dump_backtrace+0x0/0x2b8\n[   46.960719]  show_stack+0x24/0x30\n[   46.964052]  dump_stack+0x128/0x194\n[   46.967557]  print_address_description.isra.0+0x64/0x380\n[   46.972877]  __kasan_report+0x1d4/0x240\n[   46.976723]  kasan_report+0xc/0x18\n[   46.980138]  __asan_report_load4_noabort+0x18/0x20\n[   46.985027]  brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.990613]  dev_hard_start_xmit+0x1bc/0xda0\n[   46.994894]  sch_direct_xmit+0x198/0xd08\n[   46.998827]  __qdisc_run+0x37c/0x1dc0\n[   47.002500]  __dev_queue_xmit+0x1528/0x21f8\n[   47.006692]  dev_queue_xmit+0x24/0x30\n[   47.010366]  neigh_resolve_output+0x37c/0x678\n[   47.014734]  ip_finish_output2+0x598/0x2458\n[   47.018927]  __ip_finish_output+0x300/0x730\n[   47.023118]  ip_output+0x2e0/0x430\n[   47.026530]  ip_local_out+0x90/0x140\n[   47.030117]  igmpv3_sendpack+0x14c/0x228\n[   47.034049]  igmpv3_send_cr+0x384/0x6b8\n[   47.037895]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.042262]  call_timer_fn+0x1cc/0xbe8\n[   47.046021]  __run_timers+0x4d8/0xb28\n[   47.049693]  run_timer_softirq+0x24/0x40\n[   47.053626]  __do_softirq+0x2c0/0x117c\n[   47.057387]  irq_exit+0x2dc/0x388\n[   47.060715]  __handle_domain_irq+0xb4/0x158\n[   47.064908]  gic_handle_irq+0x58/0xb0\n[   47.068581]  el0_irq_naked+0x50/0x5c\n[   47.072162]\n[   47.073665] Allocated by task 328:\n[   47.077083]  save_stack+0x24/0xb0\n[   47.080410]  __kasan_kmalloc.isra.0+0xc0/0xe0\n[   47.084776]  kasan_slab_alloc+0x14/0x20\n[   47.088622]  kmem_cache_alloc+0x15c/0x468\n[   47.092643]  __alloc_skb+0xa4/0x498\n[   47.096142]  igmpv3_newpack+0x158/0xd78\n[   47.099987]  add_grhead+0x210/0x288\n[   47.103485]  add_grec+0x6b0/0xb70\n[   47.106811]  igmpv3_send_cr+0x2e0/0x6b8\n[   47.110657]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.115027]  call_timer_fn+0x1cc/0xbe8\n[   47.118785]  __run_timers+0x4d8/0xb28\n[   47.122457]  run_timer_softirq+0x24/0x40\n[   47.126389]  __do_softirq+0x2c0/0x117c\n[   47.130142]\n[   47.131643] Freed by task 180:\n[   47.134712]  save_stack+0x24/0xb0\n[   47.138041]  __kasan_slab_free+0x108/0x180\n[   47.142146]  kasan_slab_free+0x10/0x18\n[   47.145904]  slab_free_freelist_hook+0xa4/0x1b0\n[   47.150444]  kmem_cache_free+0x8c/0x528\n[   47.154292]  kfree_skbmem+0x94/0x108\n[   47.157880]  consume_skb+0x10c/0x5a8\n[   47.161466]  __dev_kfree_skb_any+0x88/0xa0\n[   47.165598]  brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil]\n[   47.171023]  brcmf_txfinalize+0xec/0x190 [brcmfmac]\n[   47.176016]  brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac]\n[   47.182056]  brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac]\n[   47.187568]  brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac]\n[   47.192529]  brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac]\n[   47.197859]  process_one_work+0x7fc/0x1a80\n[   47.201965]  worker_thread+0x31c/0xc40\n[   47.205726]  kthread+0x2d8/0x370\n[   47.208967]  ret_from_fork+0x10/0x18\n[   47.212546]\n[   47.214051] The buggy address belongs to the object at ffffff803f588280\n[   47.214051]  which belongs to the cache skbuff_head_cache of size 208\n[   47.227086] The buggy address is located 104 bytes inside of\n[   47.227086]  208-byte region [ffffff803f588280, ffffff803f588350)\n[   47.238814] The buggy address belongs to the page:\n[   47.243618] page:ffffffff00dd6200 refcount:1 mapcou\n---truncated---",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-50408",
          "url": "https://www.suse.com/security/cve/CVE-2022-50408"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250391 for CVE-2022-50408",
          "url": "https://bugzilla.suse.com/1250391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250419 for CVE-2022-50408",
          "url": "https://bugzilla.suse.com/1250419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-50408"
    },
    {
      "cve": "CVE-2023-53305",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-53305"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free\n\nFix potential use-after-free in l2cap_le_command_rej.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-53305",
          "url": "https://www.suse.com/security/cve/CVE-2023-53305"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250049 for CVE-2023-53305",
          "url": "https://bugzilla.suse.com/1250049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-53305"
    },
    {
      "cve": "CVE-2023-53365",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-53365"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: Fix skb_under_panic in ip6mr_cache_report()\n\nskbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4\n head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg\n ------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:192!\n invalid opcode: 0000 [#1] PREEMPT SMP KASAN\n CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Workqueue: ipv6_addrconf addrconf_dad_work\n RIP: 0010:skb_panic+0x152/0x1d0\n Call Trace:\n  \u003cTASK\u003e\n  skb_push+0xc4/0xe0\n  ip6mr_cache_report+0xd69/0x19b0\n  reg_vif_xmit+0x406/0x690\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  vlan_dev_hard_start_xmit+0x3ab/0x5c0\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  neigh_connected_output+0x3ed/0x570\n  ip6_finish_output2+0x5b5/0x1950\n  ip6_finish_output+0x693/0x11c0\n  ip6_output+0x24b/0x880\n  NF_HOOK.constprop.0+0xfd/0x530\n  ndisc_send_skb+0x9db/0x1400\n  ndisc_send_rs+0x12a/0x6c0\n  addrconf_dad_completed+0x3c9/0xea0\n  addrconf_dad_work+0x849/0x1420\n  process_one_work+0xa22/0x16e0\n  worker_thread+0x679/0x10c0\n  ret_from_fork+0x28/0x60\n  ret_from_fork_asm+0x11/0x20\n\nWhen setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit().\nreg_vif_xmit()\n    ip6mr_cache_report()\n        skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4\nAnd skb_push declared as:\n\tvoid *skb_push(struct sk_buff *skb, unsigned int len);\n\t\tskb-\u003edata -= len;\n\t\t//0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850\nskb-\u003edata is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-53365",
          "url": "https://www.suse.com/security/cve/CVE-2023-53365"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1249988 for CVE-2023-53365",
          "url": "https://bugzilla.suse.com/1249988"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-53365"
    },
    {
      "cve": "CVE-2025-38718",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-38718"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: linearize cloned gso packets in sctp_rcv\n\nA cloned head skb still shares these frag skbs in fraglist with the\noriginal head skb. It\u0027s not safe to access these frag skbs.\n\nsyzbot reported two use-of-uninitialized-memory bugs caused by this:\n\n  BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n   sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n   sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998\n   sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88\n   sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331\n   sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122\n   __release_sock+0x1da/0x330 net/core/sock.c:3106\n   release_sock+0x6b/0x250 net/core/sock.c:3660\n   sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360\n   sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885\n   sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031\n   inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851\n   sock_sendmsg_nosec net/socket.c:718 [inline]\n\nand\n\n  BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n   sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n   sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88\n   sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331\n   sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148\n   __release_sock+0x1d3/0x330 net/core/sock.c:3213\n   release_sock+0x6b/0x270 net/core/sock.c:3767\n   sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367\n   sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886\n   sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032\n   inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851\n   sock_sendmsg_nosec net/socket.c:712 [inline]\n\nThis patch fixes it by linearizing cloned gso packets in sctp_rcv().",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
          "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
          "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-38718",
          "url": "https://www.suse.com/security/cve/CVE-2025-38718"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1249161 for CVE-2025-38718",
          "url": "https://bugzilla.suse.com/1249161"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:bpftool-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-abi-whitelists-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-debug-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-doc-0:3.10.0-1160.143.1.el7.noarch",
            "SUSE Liberty Linux 7 LTSS:kernel-headers-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:kernel-tools-libs-devel-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:perf-0:3.10.0-1160.143.1.el7.x86_64",
            "SUSE Liberty Linux 7 LTSS:python-perf-0:3.10.0-1160.143.1.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-38718"
    }
  ]
}

BDU:2026-02276 (CVE-2023-53365)

Vulnerability from fstec – Published: 2026-02-26 – Updated: 2026-02-26 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции ip6mr_cache_report() модуля net/ipv6/ip6mr.c реализации протокола IPv6 ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость функции ip6mr_cache_report() модуля net/ipv6/ip6mr.c реализации протокола IPv6 ядра операционной системы Linux связана с неправильным отключением или освобождением ресурса. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

6.0 (Medium) CVSS 2.0


                      
                        AV:L/AC:H/Au:S/C:C/I:C/A:C

7.0 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource exhaustion

Incidents

Being clarified

Remediation

Software update

CWE

CWE-404 - Некорректная зачистка или освобождение ресурсов

Aliases

CVE-2023-53365, RHSA-2024:2394, RHSA-2024:3138, RHSA-2025:22006, RHSA-2025:22066, RHSA-2025:22072, RHSA-2025:22087, RHSA-2025:22095, RHSA-2025:22124, RHSA-2025:22910, RHSA-2025:22914, RHSA-2025:23445, RHSA-2025:23463

References

19 references

URL
https://www.cve.org/CVERecord?id=CVE-2023-53365
https://git.kernel.org/stable/c/a96d74d1076c82a4cef02c150d9996b21354c78d
https://git.kernel.org/stable/c/8382e7ed2d63e6c2daf6881fa091526dc6c879cd
https://git.kernel.org/stable/c/0438e60a00d4e335b3c36397dbf26c74b5d13ef0
https://git.kernel.org/stable/c/1683124129a4263dd5bce2475bab110e95fa0346
https://git.kernel.org/stable/c/1bb54a21f4d9b88442f8c3307c780e2db64417e4
https://git.kernel.org/stable/c/691a09eecad97e745b9aa0e3918db46d020bdacb
https://git.kernel.org/stable/c/3326c711f18d18fe6e1f5d83d3a7eab07e5a1560
https://git.kernel.org/linus/30e0191b16e8a58e4620fa3e2839ddc7b9d4281c
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.322
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.291
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.253
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.190
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.126
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.45
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.10
https://access.redhat.com/security/cve/cve-2023-53365
https://security-tracker.debian.org/tracker/CVE-2023-53365
https://ubuntu.com/security/CVE-2023-53365

Impacted products

4 products from 4 vendors

Vendors

Red Hat, Inc., Canonical Ltd., Сообщество свободного программного обеспечения

Products

Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, Linux

Versions

7 (Red Hat Enterprise Linux), 16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.2 Advanced Update Support (Red Hat Enterprise Linux), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), от 4.15 до 4.19.290 включительно (Linux), от 4.20 до 5.4.252 включительно (Linux), от 5.5 до 5.10.189 включительно (Linux), от 5.11 до 5.15.125 включительно (Linux), от 5.16 до 6.1.44 включительно (Linux), от 6.2 до 6.4.9 включительно (Linux), 9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), от 2.6.26 до 4.14.321 включительно (Linux)

Product types

Operating system

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 7, Canonical Ltd. Ubuntu 16.04 LTS, Canonical Ltd. Ubuntu 18.04 LTS, Inc. Red Hat Enterprise Linux 8, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Сообщество свободного программного обеспечения Linux от 4.15 до 4.19.290 включительно, Сообщество свободного программного обеспечения Linux от 4.20 до 5.4.252 включительно, Сообщество свободного программного обеспечения Linux от 5.5 до 5.10.189 включительно, Сообщество свободного программного обеспечения Linux от 5.11 до 5.15.125 включительно, Сообщество свободного программного обеспечения Linux от 5.16 до 6.1.44 включительно, Сообщество свободного программного обеспечения Linux от 6.2 до 6.4.9 включительно, Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Сообщество свободного программного обеспечения Linux от 2.6.26 до 4.14.321 включительно

Mitigations

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:H/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7 (Red Hat Enterprise Linux), 16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.2 Advanced Update Support (Red Hat Enterprise Linux), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), \u043e\u0442 4.15 \u0434\u043e 4.19.290 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.20 \u0434\u043e 5.4.252 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.5 \u0434\u043e 5.10.189 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.11 \u0434\u043e 5.15.125 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.16 \u0434\u043e 6.1.44 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 6.2 \u0434\u043e 6.4.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), 9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), \u043e\u0442 2.6.26 \u0434\u043e 4.14.321 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/a96d74d1076c82a4cef02c150d9996b21354c78d\nhttps://git.kernel.org/stable/c/8382e7ed2d63e6c2daf6881fa091526dc6c879cd\nhttps://git.kernel.org/stable/c/0438e60a00d4e335b3c36397dbf26c74b5d13ef0\nhttps://git.kernel.org/stable/c/1683124129a4263dd5bce2475bab110e95fa0346\nhttps://git.kernel.org/stable/c/1bb54a21f4d9b88442f8c3307c780e2db64417e4\nhttps://git.kernel.org/stable/c/691a09eecad97e745b9aa0e3918db46d020bdacb\nhttps://git.kernel.org/stable/c/3326c711f18d18fe6e1f5d83d3a7eab07e5a1560\nhttps://git.kernel.org/linus/30e0191b16e8a58e4620fa3e2839ddc7b9d4281c\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2023-53365\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2023-53365\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Ubuntu:\nhttps://ubuntu.com/security/CVE-2023-53365",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "02.08.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.02.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.02.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-02276",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-53365, RHSA-2024:2394, RHSA-2024:3138, RHSA-2025:22006, RHSA-2025:22066, RHSA-2025:22072, RHSA-2025:22087, RHSA-2025:22095, RHSA-2025:22124, RHSA-2025:22910, RHSA-2025:22914, RHSA-2025:23445, RHSA-2025:23463",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 7 , Canonical Ltd. Ubuntu 16.04 LTS , Canonical Ltd. Ubuntu 18.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Red Hat, Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.15 \u0434\u043e 4.19.290 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.20 \u0434\u043e 5.4.252 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.5 \u0434\u043e 5.10.189 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.11 \u0434\u043e 5.15.125 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.16 \u0434\u043e 6.1.44 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.2 \u0434\u043e 6.4.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Red Hat, Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support , Red Hat, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 2.6.26 \u0434\u043e 4.14.321 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 ip6mr_cache_report() \u043c\u043e\u0434\u0443\u043b\u044f net/ipv6/ip6mr.c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv6 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u0437\u0430\u0447\u0438\u0441\u0442\u043a\u0430 \u0438\u043b\u0438 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 (CWE-404)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 ip6mr_cache_report() \u043c\u043e\u0434\u0443\u043b\u044f net/ipv6/ip6mr.c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv6 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u0438\u043b\u0438 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cve.org/CVERecord?id=CVE-2023-53365\nhttps://git.kernel.org/stable/c/a96d74d1076c82a4cef02c150d9996b21354c78d\nhttps://git.kernel.org/stable/c/8382e7ed2d63e6c2daf6881fa091526dc6c879cd\nhttps://git.kernel.org/stable/c/0438e60a00d4e335b3c36397dbf26c74b5d13ef0\nhttps://git.kernel.org/stable/c/1683124129a4263dd5bce2475bab110e95fa0346\nhttps://git.kernel.org/stable/c/1bb54a21f4d9b88442f8c3307c780e2db64417e4\nhttps://git.kernel.org/stable/c/691a09eecad97e745b9aa0e3918db46d020bdacb\nhttps://git.kernel.org/stable/c/3326c711f18d18fe6e1f5d83d3a7eab07e5a1560\nhttps://git.kernel.org/linus/30e0191b16e8a58e4620fa3e2839ddc7b9d4281c\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.322\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.291\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.253\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.190\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.126\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.45\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.10\nhttps://access.redhat.com/security/cve/cve-2023-53365\nhttps://security-tracker.debian.org/tracker/CVE-2023-53365\nhttps://ubuntu.com/security/CVE-2023-53365",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-404",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7)"
}

CVE-2022-3640 (GCVE-0-2022-3640)

Vulnerability from cvelistv5 – Published: 2022-10-21 00:00 – Updated: 2024-08-03 01:14

Title

Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free

Summary

A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-119 - Memory Corruption -> CWE-416 Use After Free

Assigner

VulDB mitre root Scorecard

References

7 references

URL	Tags
https://git.kernel.org/pub/scm/linux/kernel/git/b…
https://vuldb.com/?id.211944
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
Linux	Kernel	Affected: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:14:03.216Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=42cf46dea905a80f6de218e837ba4d4cc33d6979"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.211944"
          },
          {
            "name": "FEDORA-2022-64ab9153c0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD7VWUT7YAU4CJ247IF44NGVOAODAJGC/"
          },
          {
            "name": "FEDORA-2022-65a0a3504a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGOIRR72OAFE53XZRUDZDP7INGLIC3E3/"
          },
          {
            "name": "FEDORA-2022-7aadaadebc",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG2UPX3MQ7RKRJEUMGEH2TLPKZJCBU5C/"
          },
          {
            "name": "[debian-lts-announce] 20221222 [SECURITY] [DLA 3244-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
          },
          {
            "name": "[debian-lts-announce] 20221223 [SECURITY] [DLA 3245-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kernel",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119 Memory Corruption -\u003e CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-24T00:00:00.000Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=42cf46dea905a80f6de218e837ba4d4cc33d6979"
        },
        {
          "url": "https://vuldb.com/?id.211944"
        },
        {
          "name": "FEDORA-2022-64ab9153c0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD7VWUT7YAU4CJ247IF44NGVOAODAJGC/"
        },
        {
          "name": "FEDORA-2022-65a0a3504a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGOIRR72OAFE53XZRUDZDP7INGLIC3E3/"
        },
        {
          "name": "FEDORA-2022-7aadaadebc",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG2UPX3MQ7RKRJEUMGEH2TLPKZJCBU5C/"
        },
        {
          "name": "[debian-lts-announce] 20221222 [SECURITY] [DLA 3244-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
        },
        {
          "name": "[debian-lts-announce] 20221223 [SECURITY] [DLA 3245-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html"
        }
      ],
      "title": "Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free",
      "x_generator": "vuldb.com"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2022-3640",
    "datePublished": "2022-10-21T00:00:00.000Z",
    "dateReserved": "2022-10-21T00:00:00.000Z",
    "dateUpdated": "2024-08-03T01:14:03.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-50341 (GCVE-0-2022-50341)

Vulnerability from cvelistv5 – Published: 2025-09-16 16:11 – Updated: 2026-08-05 08:58

Title

cifs: fix oops during encryption

Summary

In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100 crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880 smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100 compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0 cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 18:19 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root Scorecard

References

6 references

URL	Tags
https://git.kernel.org/stable/c/e8e2861cc3258dbe4…
https://git.kernel.org/stable/c/fe6ea044c4f05706c…
https://git.kernel.org/stable/c/bf0543b93740916ee…
https://git.kernel.org/stable/c/a13e51760703f71c2…
https://git.kernel.org/stable/c/e8d16a54842d609fd…
https://git.kernel.org/stable/c/f7f291e14dde32a07…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398 , < e8e2861cc3258dbe407d01ea8c59bb5a53132301 (git) Affected: 026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398 , < fe6ea044c4f05706cb71040055b1c70c6c8275e0 (git) Affected: 026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398 , < bf0543b93740916ee91956f9a63da6fc0d79daaa (git) Affected: 026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398 , < a13e51760703f71c25d5fc1f4a62dfa4b0cc80e9 (git) Affected: 026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398 , < e8d16a54842d609fd4a3ed2d81d4333d6329aa94 (git) Affected: 026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398 , < f7f291e14dde32a07b1f0aa06921d28f875a7b54 (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 5.4.229 , ≤ 5.4.* (semver) Unaffected: 5.10.163 , ≤ 5.10.* (semver) Unaffected: 5.15.87 , ≤ 5.15.* (semver) Unaffected: 6.0.16 , ≤ 6.0.* (semver) Unaffected: 6.1.1 , ≤ 6.1.* (semver) Unaffected: 6.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50341",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:19:48.496611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:22:57.726Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/cifsglob.h",
            "fs/cifs/cifsproto.h",
            "fs/cifs/misc.c",
            "fs/cifs/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e8e2861cc3258dbe407d01ea8c59bb5a53132301",
              "status": "affected",
              "version": "026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398",
              "versionType": "git"
            },
            {
              "lessThan": "fe6ea044c4f05706cb71040055b1c70c6c8275e0",
              "status": "affected",
              "version": "026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398",
              "versionType": "git"
            },
            {
              "lessThan": "bf0543b93740916ee91956f9a63da6fc0d79daaa",
              "status": "affected",
              "version": "026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398",
              "versionType": "git"
            },
            {
              "lessThan": "a13e51760703f71c25d5fc1f4a62dfa4b0cc80e9",
              "status": "affected",
              "version": "026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398",
              "versionType": "git"
            },
            {
              "lessThan": "e8d16a54842d609fd4a3ed2d81d4333d6329aa94",
              "status": "affected",
              "version": "026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398",
              "versionType": "git"
            },
            {
              "lessThan": "f7f291e14dde32a07b1f0aa06921d28f875a7b54",
              "status": "affected",
              "version": "026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/cifsglob.h",
            "fs/cifs/cifsproto.h",
            "fs/cifs/misc.c",
            "fs/cifs/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix oops during encryption\n\nWhen running xfstests against Azure the following oops occurred on an\narm64 system\n\n  Unable to handle kernel write to read-only memory at virtual address\n  ffff0001221cf000\n  Mem abort info:\n    ESR = 0x9600004f\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x0f: level 3 permission fault\n  Data abort info:\n    ISV = 0, ISS = 0x0000004f\n    CM = 0, WnR = 1\n  swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000\n  [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003,\n  pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787\n  Internal error: Oops: 9600004f [#1] PREEMPT SMP\n  ...\n  pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)\n  pc : __memcpy+0x40/0x230\n  lr : scatterwalk_copychunks+0xe0/0x200\n  sp : ffff800014e92de0\n  x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008\n  x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008\n  x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000\n  x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014\n  x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058\n  x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590\n  x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580\n  x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005\n  x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001\n  x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000\n  Call trace:\n   __memcpy+0x40/0x230\n   scatterwalk_map_and_copy+0x98/0x100\n   crypto_ccm_encrypt+0x150/0x180\n   crypto_aead_encrypt+0x2c/0x40\n   crypt_message+0x750/0x880\n   smb3_init_transform_rq+0x298/0x340\n   smb_send_rqst.part.11+0xd8/0x180\n   smb_send_rqst+0x3c/0x100\n   compound_send_recv+0x534/0xbc0\n   smb2_query_info_compound+0x32c/0x440\n   smb2_set_ea+0x438/0x4c0\n   cifs_xattr_set+0x5d4/0x7c0\n\nThis is because in scatterwalk_copychunks(), we attempted to write to\na buffer (@sign) that was allocated in the stack (vmalloc area) by\ncrypt_message() and thus accessing its remaining 8 (x2) bytes ended up\ncrossing a page boundary.\n\nTo simply fix it, we could just pass @sign kmalloc\u0027d from\ncrypt_message() and then we\u0027re done.  Luckily, we don\u0027t seem to pass\nany other vmalloc\u0027d buffers in smb_rqst::rq_iov...\n\nInstead, let\u0027s map the correct pages and offsets from vmalloc buffers\nas well in cifs_sg_set_buf() and then avoiding such oopses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - This is CIFS/SMB3 client encryption in fs/cifs, reached via local filesystem operations on an already-mounted share, not a network-facing server like ksmbd/nfsd.\nAC:L - An attacker with access to an encrypted SMB3 mount can repeatedly issue operations that encrypt (or decrypt) messages; VMAP_STACK is default on x86_64/arm64, and the page-boundary condition is reliably hittable (as in the reported xfstests oops), including via retries under kstack offset randomization.\nPR:L - An unprivileged local user who can access a mounted encrypted CIFS/SMB3 share (common for Azure Files and enterprise mounts) can trigger the path via setxattr or other ordinary filesystem operations without root.\nUI:N - The attacker themselves performs the filesystem operation that drives encryption; no separate victim action is required beyond the pre-existing encrypted mount.\nS:U - The corruption and crash stay within the local kernel\u2019s security authority; this is not a VM/IOMMU/sandbox boundary crossing.\nC:H - The flaw is an out-of-bounds write into an unintended kernel page via scatterwalk\u2019s page+1 advance on a mis-mapped vmalloc buffer, which is memory corruption that can be leveraged for information disclosure.\nI:H - scatterwalk writes the AEAD signature across a page boundary into the wrong page frame (sg_page+1), which is an out-of-bounds kernel write exploitable for integrity compromise and control-flow hijacking.\nA:H - The bug produces a demonstrable kernel oops (write to read-only memory during crypto_ccm_encrypt), so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:18.553Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e8e2861cc3258dbe407d01ea8c59bb5a53132301"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe6ea044c4f05706cb71040055b1c70c6c8275e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf0543b93740916ee91956f9a63da6fc0d79daaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a13e51760703f71c25d5fc1f4a62dfa4b0cc80e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8d16a54842d609fd4a3ed2d81d4333d6329aa94"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7f291e14dde32a07b1f0aa06921d28f875a7b54"
        }
      ],
      "title": "cifs: fix oops during encryption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50341",
    "datePublished": "2025-09-16T16:11:20.838Z",
    "dateReserved": "2025-09-16T16:03:27.881Z",
    "dateUpdated": "2026-08-05T08:58:18.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50386 (GCVE-0-2022-50386)

Vulnerability from cvelistv5 – Published: 2025-09-18 13:33 – Updated: 2026-08-05 08:58

Title

Bluetooth: L2CAP: Fix user-after-free

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 18:49 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root Scorecard

References

9 references

URL	Tags
https://git.kernel.org/stable/c/11e40d6c0823f699d…
https://git.kernel.org/stable/c/843fc4e386dd84b80…
https://git.kernel.org/stable/c/d91fc2836562f299f…
https://git.kernel.org/stable/c/7d6f9cb24d2b2f6b6…
https://git.kernel.org/stable/c/0c108cf3ad386e008…
https://git.kernel.org/stable/c/d1e894f950ad48897…
https://git.kernel.org/stable/c/6ffde6e03085874ae…
https://git.kernel.org/stable/c/15fc21695eb606bdc…
https://git.kernel.org/stable/c/35fcbc4243aad7e7d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < 11e40d6c0823f699d8ad501e48d1c3ae4be386cd (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < 843fc4e386dd84b806a7f07fb062d8c3a44e5364 (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < d91fc2836562f299f34e361e089e9fe154da4f73 (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < 7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45 (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < 0c108cf3ad386e0084277093b55a351c49e0be27 (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < d1e894f950ad48897d1a7cb05909ea29d8c3810e (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < 6ffde6e03085874ae22263ff4cef4869f797e84f (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < 15fc21695eb606bdc5d483b92118ee42610a952d (git) Affected: 3df91ea20e744344100b10ae69a17211fcf5b207 , < 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f (git)
Linux	Linux	Affected: 3.4 Unaffected: 0 , < 3.4 (semver) Unaffected: 4.9.331 , ≤ 4.9.* (semver) Unaffected: 4.14.296 , ≤ 4.14.* (semver) Unaffected: 4.19.262 , ≤ 4.19.* (semver) Unaffected: 5.4.220 , ≤ 5.4.* (semver) Unaffected: 5.10.150 , ≤ 5.10.* (semver) Unaffected: 5.15.75 , ≤ 5.15.* (semver) Unaffected: 5.19.17 , ≤ 5.19.* (semver) Unaffected: 6.0.3 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:49:08.856293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:53:04.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11e40d6c0823f699d8ad501e48d1c3ae4be386cd",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "843fc4e386dd84b806a7f07fb062d8c3a44e5364",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "d91fc2836562f299f34e361e089e9fe154da4f73",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "0c108cf3ad386e0084277093b55a351c49e0be27",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "d1e894f950ad48897d1a7cb05909ea29d8c3810e",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "6ffde6e03085874ae22263ff4cef4869f797e84f",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "15fc21695eb606bdc5d483b92118ee42610a952d",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            },
            {
              "lessThan": "35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f",
              "status": "affected",
              "version": "3df91ea20e744344100b10ae69a17211fcf5b207",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.331",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.262",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.331",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.296",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.262",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.220",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix user-after-free\n\nThis uses l2cap_chan_hold_unless_zero() after calling\n__l2cap_get_chan_blah() to prevent the following trace:\n\nBluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref\n*kref)\nBluetooth: chan 0000000023c4974d\nBluetooth: parent 00000000ae861c08\n==================================================================\nBUG: KASAN: use-after-free in __mutex_waiter_is_first\nkernel/locking/mutex.c:191 [inline]\nBUG: KASAN: use-after-free in __mutex_lock_common\nkernel/locking/mutex.c:671 [inline]\nBUG: KASAN: use-after-free in __mutex_lock+0x278/0x400\nkernel/locking/mutex.c:729\nRead of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in BR/EDR L2CAP signaling (`l2cap_connect_create_rsp`) reached via ACL frames from a Bluetooth peer (`l2cap_recv_acldata` \u2192 `l2cap_sig_channel`), so exploitation requires adjacent-network Bluetooth proximity.\nAC:L - A remote peer can send L2CAP_CONN_RSP/CREATE_CHAN_RSP while concurrently forcing channel teardown (disconnect/link drop), controlling both sides of the UAF race, so success does not depend on conditions outside attacker influence.\nPR:N - L2CAP connect responses are processed on the signaling CID for established ACL links at default BT_SECURITY_LOW/SDP without authentication or local privileges on the victim host.\nUI:N - No additional victim action is required beyond ordinary Bluetooth connection activity; a malicious adjacent device can trigger the path during normal connect/reconnect flows.\nS:U - This is a standard in-kernel L2CAP channel UAF that enables privilege impact only within the same kernel security authority, not a boundary crossing such as VM/IOMMU escape.\nC:H - Use-after-free of the `l2cap_chan` object allows reclaim and attacker-controlled contents, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF enables heap spray and corruption of the freed channel/mutex-related state, providing a path to arbitrary write and control-flow hijacking in the kernel.\nA:H - The KASAN report shows a kernel UAF during `l2cap_chan_lock`, which can oops/panic the kernel even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:30.414Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11e40d6c0823f699d8ad501e48d1c3ae4be386cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/843fc4e386dd84b806a7f07fb062d8c3a44e5364"
        },
        {
          "url": "https://git.kernel.org/stable/c/d91fc2836562f299f34e361e089e9fe154da4f73"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c108cf3ad386e0084277093b55a351c49e0be27"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1e894f950ad48897d1a7cb05909ea29d8c3810e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ffde6e03085874ae22263ff4cef4869f797e84f"
        },
        {
          "url": "https://git.kernel.org/stable/c/15fc21695eb606bdc5d483b92118ee42610a952d"
        },
        {
          "url": "https://git.kernel.org/stable/c/35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix user-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50386",
    "datePublished": "2025-09-18T13:33:07.191Z",
    "dateReserved": "2025-09-17T14:53:06.997Z",
    "dateUpdated": "2026-08-05T08:58:30.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50408 (GCVE-0-2022-50408)

Vulnerability from cvelistv5 – Published: 2025-09-18 16:03 – Updated: 2026-08-05 08:58

Title

wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.tx_bytes += skb->len; [ 46.912801] ================================================================== [ 46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328 [ 46.935991] [ 46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G O 5.4.199-[REDACTED] #1 [ 46.947255] Hardware name: [REDACTED] [ 46.954568] Call trace: [ 46.957037] dump_backtrace+0x0/0x2b8 [ 46.960719] show_stack+0x24/0x30 [ 46.964052] dump_stack+0x128/0x194 [ 46.967557] print_address_description.isra.0+0x64/0x380 [ 46.972877] __kasan_report+0x1d4/0x240 [ 46.976723] kasan_report+0xc/0x18 [ 46.980138] __asan_report_load4_noabort+0x18/0x20 [ 46.985027] brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.990613] dev_hard_start_xmit+0x1bc/0xda0 [ 46.994894] sch_direct_xmit+0x198/0xd08 [ 46.998827] __qdisc_run+0x37c/0x1dc0 [ 47.002500] __dev_queue_xmit+0x1528/0x21f8 [ 47.006692] dev_queue_xmit+0x24/0x30 [ 47.010366] neigh_resolve_output+0x37c/0x678 [ 47.014734] ip_finish_output2+0x598/0x2458 [ 47.018927] __ip_finish_output+0x300/0x730 [ 47.023118] ip_output+0x2e0/0x430 [ 47.026530] ip_local_out+0x90/0x140 [ 47.030117] igmpv3_sendpack+0x14c/0x228 [ 47.034049] igmpv3_send_cr+0x384/0x6b8 [ 47.037895] igmp_ifc_timer_expire+0x4c/0x118 [ 47.042262] call_timer_fn+0x1cc/0xbe8 [ 47.046021] __run_timers+0x4d8/0xb28 [ 47.049693] run_timer_softirq+0x24/0x40 [ 47.053626] __do_softirq+0x2c0/0x117c [ 47.057387] irq_exit+0x2dc/0x388 [ 47.060715] __handle_domain_irq+0xb4/0x158 [ 47.064908] gic_handle_irq+0x58/0xb0 [ 47.068581] el0_irq_naked+0x50/0x5c [ 47.072162] [ 47.073665] Allocated by task 328: [ 47.077083] save_stack+0x24/0xb0 [ 47.080410] __kasan_kmalloc.isra.0+0xc0/0xe0 [ 47.084776] kasan_slab_alloc+0x14/0x20 [ 47.088622] kmem_cache_alloc+0x15c/0x468 [ 47.092643] __alloc_skb+0xa4/0x498 [ 47.096142] igmpv3_newpack+0x158/0xd78 [ 47.099987] add_grhead+0x210/0x288 [ 47.103485] add_grec+0x6b0/0xb70 [ 47.106811] igmpv3_send_cr+0x2e0/0x6b8 [ 47.110657] igmp_ifc_timer_expire+0x4c/0x118 [ 47.115027] call_timer_fn+0x1cc/0xbe8 [ 47.118785] __run_timers+0x4d8/0xb28 [ 47.122457] run_timer_softirq+0x24/0x40 [ 47.126389] __do_softirq+0x2c0/0x117c [ 47.130142] [ 47.131643] Freed by task 180: [ 47.134712] save_stack+0x24/0xb0 [ 47.138041] __kasan_slab_free+0x108/0x180 [ 47.142146] kasan_slab_free+0x10/0x18 [ 47.145904] slab_free_freelist_hook+0xa4/0x1b0 [ 47.150444] kmem_cache_free+0x8c/0x528 [ 47.154292] kfree_skbmem+0x94/0x108 [ 47.157880] consume_skb+0x10c/0x5a8 [ 47.161466] __dev_kfree_skb_any+0x88/0xa0 [ 47.165598] brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil] [ 47.171023] brcmf_txfinalize+0xec/0x190 [brcmfmac] [ 47.176016] brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac] [ 47.182056] brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac] [ 47.187568] brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac] [ 47.192529] brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac] [ 47.197859] process_one_work+0x7fc/0x1a80 [ 47.201965] worker_thread+0x31c/0xc40 [ 47.205726] kthread+0x2d8/0x370 [ 47.208967] ret_from_fork+0x10/0x18 [ 47.212546] [ 47.214051] The buggy address belongs to the object at ffffff803f588280 [ 47.214051] which belongs to the cache skbuff_head_cache of size 208 [ 47.227086] The buggy address is located 104 bytes inside of [ 47.227086] 208-byte region [ffffff803f588280, ffffff803f588350) [ 47.238814] The buggy address belongs to the page: [ 47.243618] page:ffffffff00dd6200 refcount:1 mapcou ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 19:08 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/1613a7b24f1a7467c…
https://git.kernel.org/stable/c/d79f4d903e14dde82…
https://git.kernel.org/stable/c/49c742afd60f552fc…
https://git.kernel.org/stable/c/e01d96494a9de0f48…
https://git.kernel.org/stable/c/232d59eca07f6ea27…
https://git.kernel.org/stable/c/27574a3f421c3a169…
https://git.kernel.org/stable/c/c369836cff98d3877…
https://git.kernel.org/stable/c/3f42faf6db431e04b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < 1613a7b24f1a7467cb727ba3ec77c9a808383560 (git) Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < d79f4d903e14dde822c60b5fd3bedc5a289d25df (git) Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < 49c742afd60f552fce7799287080db02bffe1db2 (git) Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < e01d96494a9de0f48b1167f0494f6d929fa773ed (git) Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < 232d59eca07f6ea27307022a33d226aff373bd02 (git) Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < 27574a3f421c3a1694d0207f37c6bbf23d66978e (git) Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < c369836cff98d3877f98c98e15c0151462812d96 (git) Affected: b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4 , < 3f42faf6db431e04bf942d2ebe3ae88975723478 (git)
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 4.14.296 , ≤ 4.14.* (semver) Unaffected: 4.19.262 , ≤ 4.19.* (semver) Unaffected: 5.4.220 , ≤ 5.4.* (semver) Unaffected: 5.10.150 , ≤ 5.10.* (semver) Unaffected: 5.15.75 , ≤ 5.15.* (semver) Unaffected: 5.19.17 , ≤ 5.19.* (semver) Unaffected: 6.0.3 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:08:23.930157Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:13:08.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1613a7b24f1a7467cb727ba3ec77c9a808383560",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            },
            {
              "lessThan": "d79f4d903e14dde822c60b5fd3bedc5a289d25df",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            },
            {
              "lessThan": "49c742afd60f552fce7799287080db02bffe1db2",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            },
            {
              "lessThan": "e01d96494a9de0f48b1167f0494f6d929fa773ed",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            },
            {
              "lessThan": "232d59eca07f6ea27307022a33d226aff373bd02",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            },
            {
              "lessThan": "27574a3f421c3a1694d0207f37c6bbf23d66978e",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            },
            {
              "lessThan": "c369836cff98d3877f98c98e15c0151462812d96",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            },
            {
              "lessThan": "3f42faf6db431e04bf942d2ebe3ae88975723478",
              "status": "affected",
              "version": "b1a2a41126fc582a3d5613aa2d3e632b2eb1a2c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.262",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.296",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.262",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.220",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()\n\n\u003e ret = brcmf_proto_tx_queue_data(drvr, ifp-\u003eifidx, skb);\n\nmay be schedule, and then complete before the line\n\n\u003e ndev-\u003estats.tx_bytes += skb-\u003elen;\n\n[   46.912801] ==================================================================\n[   46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328\n[   46.935991]\n[   46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G           O      5.4.199-[REDACTED] #1\n[   46.947255] Hardware name: [REDACTED]\n[   46.954568] Call trace:\n[   46.957037]  dump_backtrace+0x0/0x2b8\n[   46.960719]  show_stack+0x24/0x30\n[   46.964052]  dump_stack+0x128/0x194\n[   46.967557]  print_address_description.isra.0+0x64/0x380\n[   46.972877]  __kasan_report+0x1d4/0x240\n[   46.976723]  kasan_report+0xc/0x18\n[   46.980138]  __asan_report_load4_noabort+0x18/0x20\n[   46.985027]  brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.990613]  dev_hard_start_xmit+0x1bc/0xda0\n[   46.994894]  sch_direct_xmit+0x198/0xd08\n[   46.998827]  __qdisc_run+0x37c/0x1dc0\n[   47.002500]  __dev_queue_xmit+0x1528/0x21f8\n[   47.006692]  dev_queue_xmit+0x24/0x30\n[   47.010366]  neigh_resolve_output+0x37c/0x678\n[   47.014734]  ip_finish_output2+0x598/0x2458\n[   47.018927]  __ip_finish_output+0x300/0x730\n[   47.023118]  ip_output+0x2e0/0x430\n[   47.026530]  ip_local_out+0x90/0x140\n[   47.030117]  igmpv3_sendpack+0x14c/0x228\n[   47.034049]  igmpv3_send_cr+0x384/0x6b8\n[   47.037895]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.042262]  call_timer_fn+0x1cc/0xbe8\n[   47.046021]  __run_timers+0x4d8/0xb28\n[   47.049693]  run_timer_softirq+0x24/0x40\n[   47.053626]  __do_softirq+0x2c0/0x117c\n[   47.057387]  irq_exit+0x2dc/0x388\n[   47.060715]  __handle_domain_irq+0xb4/0x158\n[   47.064908]  gic_handle_irq+0x58/0xb0\n[   47.068581]  el0_irq_naked+0x50/0x5c\n[   47.072162]\n[   47.073665] Allocated by task 328:\n[   47.077083]  save_stack+0x24/0xb0\n[   47.080410]  __kasan_kmalloc.isra.0+0xc0/0xe0\n[   47.084776]  kasan_slab_alloc+0x14/0x20\n[   47.088622]  kmem_cache_alloc+0x15c/0x468\n[   47.092643]  __alloc_skb+0xa4/0x498\n[   47.096142]  igmpv3_newpack+0x158/0xd78\n[   47.099987]  add_grhead+0x210/0x288\n[   47.103485]  add_grec+0x6b0/0xb70\n[   47.106811]  igmpv3_send_cr+0x2e0/0x6b8\n[   47.110657]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.115027]  call_timer_fn+0x1cc/0xbe8\n[   47.118785]  __run_timers+0x4d8/0xb28\n[   47.122457]  run_timer_softirq+0x24/0x40\n[   47.126389]  __do_softirq+0x2c0/0x117c\n[   47.130142]\n[   47.131643] Freed by task 180:\n[   47.134712]  save_stack+0x24/0xb0\n[   47.138041]  __kasan_slab_free+0x108/0x180\n[   47.142146]  kasan_slab_free+0x10/0x18\n[   47.145904]  slab_free_freelist_hook+0xa4/0x1b0\n[   47.150444]  kmem_cache_free+0x8c/0x528\n[   47.154292]  kfree_skbmem+0x94/0x108\n[   47.157880]  consume_skb+0x10c/0x5a8\n[   47.161466]  __dev_kfree_skb_any+0x88/0xa0\n[   47.165598]  brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil]\n[   47.171023]  brcmf_txfinalize+0xec/0x190 [brcmfmac]\n[   47.176016]  brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac]\n[   47.182056]  brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac]\n[   47.187568]  brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac]\n[   47.192529]  brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac]\n[   47.197859]  process_one_work+0x7fc/0x1a80\n[   47.201965]  worker_thread+0x31c/0xc40\n[   47.205726]  kthread+0x2d8/0x370\n[   47.208967]  ret_from_fork+0x10/0x18\n[   47.212546]\n[   47.214051] The buggy address belongs to the object at ffffff803f588280\n[   47.214051]  which belongs to the cache skbuff_head_cache of size 208\n[   47.227086] The buggy address is located 104 bytes inside of\n[   47.227086]  208-byte region [ffffff803f588280, ffffff803f588350)\n[   47.238814] The buggy address belongs to the page:\n[   47.243618] page:ffffffff00dd6200 refcount:1 mapcou\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in brcmfmac\u0027s ndo_start_xmit TX path (brcmf_netdev_start_xmit \u2192 brcmf_proto_tx_queue_data), reached when the local stack transmits through the WiFi interface; it is not an RX/WiFi-frame-injection path, so Local applies rather than Adjacent/Network.\nAC:L - The attacker drives packet TX which both enters start_xmit and schedules async bus completion (brcmf_sdio_trigger_dpc/USB URB/PCIe TX status) that frees the skb, and can retry by flooding; the race was hit in practice (KASAN), so success does not depend on attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can open sockets and send traffic that is routed out a brcmfmac wlan interface (typical on Android phones and Broadcom/Cypress embedded devices), with no capability or init-namespace root required.\nUI:N - The attacker triggers the race solely by generating their own TX traffic on the interface; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - The use-after-free corrupts host-kernel skbuff slab state within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a slab use-after-free read of skb-\u003elen after brcmf_txfinalize frees the skbuff; per UAF guidance, reclaim/spray of the freed object enables kernel memory disclosure (including via the value later visible in interface TX stats).\nI:H - The same skbuff use-after-free is a reclaimable heap object under attacker-driven TX load; per UAF guidance this class of bug enables heap corruption and control-flow hijack primitives, so Integrity is High.\nA:H - The documented failure is a KASAN use-after-free in brcmf_netdev_start_xmit that oopses/panics the kernel, and any UAF scores Availability High even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:38.195Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1613a7b24f1a7467cb727ba3ec77c9a808383560"
        },
        {
          "url": "https://git.kernel.org/stable/c/d79f4d903e14dde822c60b5fd3bedc5a289d25df"
        },
        {
          "url": "https://git.kernel.org/stable/c/49c742afd60f552fce7799287080db02bffe1db2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e01d96494a9de0f48b1167f0494f6d929fa773ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/232d59eca07f6ea27307022a33d226aff373bd02"
        },
        {
          "url": "https://git.kernel.org/stable/c/27574a3f421c3a1694d0207f37c6bbf23d66978e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c369836cff98d3877f98c98e15c0151462812d96"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f42faf6db431e04bf942d2ebe3ae88975723478"
        }
      ],
      "title": "wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50408",
    "datePublished": "2025-09-18T16:03:53.197Z",
    "dateReserved": "2025-09-17T14:53:07.001Z",
    "dateUpdated": "2026-08-05T08:58:38.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-53305 (GCVE-0-2023-53305)

Vulnerability from cvelistv5 – Published: 2025-09-16 16:11 – Updated: 2026-08-05 09:13

Title

Bluetooth: L2CAP: Fix use-after-free

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 18:23 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/e76bab1b7afa580cd…
https://git.kernel.org/stable/c/1a40c56e8bff3e424…
https://git.kernel.org/stable/c/fe49aa73cca660871…
https://git.kernel.org/stable/c/2958cf9f805b9f0bd…
https://git.kernel.org/stable/c/548a6b64b3c0688f0…
https://git.kernel.org/stable/c/149daab45922ab1ac…
https://git.kernel.org/stable/c/255be681502914406…
https://git.kernel.org/stable/c/f752a0b334bb95fe9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < e76bab1b7afa580cd76362540fc37551ada4359b (git) Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < 1a40c56e8bff3e424724d78a9a6b3272dd8a371d (git) Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < fe49aa73cca6608714477b74bfc6874b9db979df (git) Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < 2958cf9f805b9f0bdc4a761bf6ea281eb8d44f8e (git) Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < 548a6b64b3c0688f01119a6fcccceb41f8c984e4 (git) Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < 149daab45922ab1ac7f0cbeacab7251a46bf5e63 (git) Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < 255be68150291440657b2cdb09420b69441af3d8 (git) Affected: 71fb419724fadab4efdf98210aa3fe053bd81d29 , < f752a0b334bb95fe9b42ecb511e0864e2768046f (git)
Linux	Linux	Affected: 3.14 Unaffected: 0 , < 3.14 (semver) Unaffected: 4.14.324 , ≤ 4.14.* (semver) Unaffected: 4.19.293 , ≤ 4.19.* (semver) Unaffected: 5.4.255 , ≤ 5.4.* (semver) Unaffected: 5.10.192 , ≤ 5.10.* (semver) Unaffected: 5.15.128 , ≤ 5.15.* (semver) Unaffected: 6.1.47 , ≤ 6.1.* (semver) Unaffected: 6.4.12 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53305",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:23:06.561439Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:32:56.186Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e76bab1b7afa580cd76362540fc37551ada4359b",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            },
            {
              "lessThan": "1a40c56e8bff3e424724d78a9a6b3272dd8a371d",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            },
            {
              "lessThan": "fe49aa73cca6608714477b74bfc6874b9db979df",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            },
            {
              "lessThan": "2958cf9f805b9f0bdc4a761bf6ea281eb8d44f8e",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            },
            {
              "lessThan": "548a6b64b3c0688f01119a6fcccceb41f8c984e4",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            },
            {
              "lessThan": "149daab45922ab1ac7f0cbeacab7251a46bf5e63",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            },
            {
              "lessThan": "255be68150291440657b2cdb09420b69441af3d8",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            },
            {
              "lessThan": "f752a0b334bb95fe9b42ecb511e0864e2768046f",
              "status": "affected",
              "version": "71fb419724fadab4efdf98210aa3fe053bd81d29",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.324",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.255",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.324",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.293",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.255",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.192",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.128",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.47",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.12",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free\n\nFix potential use-after-free in l2cap_le_command_rej."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is reached when a Bluetooth LE peer sends an L2CAP Command Reject on the LE signaling CID (hci_rx_work \u2192 l2cap_recv_acldata \u2192 l2cap_le_sig_channel \u2192 l2cap_le_command_rej), which requires adjacency on the Bluetooth radio segment.\nAC:L - An attacker who is the LE peer can send COMMAND_REJ with the ident from a pending LE CoC request and reliably hit the missing hold/put window; no conditions beyond the attacker\u0027s control are required.\nPR:N - LE ACL/L2CAP signaling is processed for an established HCI LE connection with no pairing, encryption, or local capability check before l2cap_le_command_rej runs.\nUI:N - Exploitation only needs an LE link and a matching pending channel ident; no additional victim action is required at exploit time once the stack is in that normal operational state.\nS:U - Impact is confined to the local kernel Bluetooth/L2CAP authority (memory corruption / privilege escalation on the host), with no cross-boundary escape.\nC:H - This is a use-after-free of struct l2cap_chan; UAF enables heap reuse and arbitrary kernel read primitives.\nI:H - The same UAF enables heap spraying and arbitrary write / control-flow hijacking in kernel context.\nA:H - Dereferencing the freed channel (e.g., in l2cap_chan_unlock after l2cap_chan_del) can oops/panic the kernel even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:25.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e76bab1b7afa580cd76362540fc37551ada4359b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a40c56e8bff3e424724d78a9a6b3272dd8a371d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe49aa73cca6608714477b74bfc6874b9db979df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2958cf9f805b9f0bdc4a761bf6ea281eb8d44f8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/548a6b64b3c0688f01119a6fcccceb41f8c984e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/149daab45922ab1ac7f0cbeacab7251a46bf5e63"
        },
        {
          "url": "https://git.kernel.org/stable/c/255be68150291440657b2cdb09420b69441af3d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f752a0b334bb95fe9b42ecb511e0864e2768046f"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53305",
    "datePublished": "2025-09-16T16:11:44.845Z",
    "dateReserved": "2025-09-16T08:09:37.994Z",
    "dateUpdated": "2026-08-05T09:13:25.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-53365 (GCVE-0-2023-53365)

Vulnerability from cvelistv5 – Published: 2025-09-17 14:56 – Updated: 2026-05-11 19:43

Title

ip6mr: Fix skb_under_panic in ip6mr_cache_report()

Summary

In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: <TASK> skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20 When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit() ip6mr_cache_report() skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4 And skb_push declared as: void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 18:45 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a96d74d1076c82a4c…
https://git.kernel.org/stable/c/8382e7ed2d63e6c2d…
https://git.kernel.org/stable/c/0438e60a00d4e335b…
https://git.kernel.org/stable/c/1683124129a4263dd…
https://git.kernel.org/stable/c/1bb54a21f4d9b8844…
https://git.kernel.org/stable/c/691a09eecad97e745…
https://git.kernel.org/stable/c/3326c711f18d18fe6…
https://git.kernel.org/stable/c/30e0191b16e8a58e4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < a96d74d1076c82a4cef02c150d9996b21354c78d (git) Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < 8382e7ed2d63e6c2daf6881fa091526dc6c879cd (git) Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < 0438e60a00d4e335b3c36397dbf26c74b5d13ef0 (git) Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < 1683124129a4263dd5bce2475bab110e95fa0346 (git) Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < 1bb54a21f4d9b88442f8c3307c780e2db64417e4 (git) Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < 691a09eecad97e745b9aa0e3918db46d020bdacb (git) Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < 3326c711f18d18fe6e1f5d83d3a7eab07e5a1560 (git) Affected: 14fb64e1f449ef6666f1c3a3fa4e13aec669b98d , < 30e0191b16e8a58e4620fa3e2839ddc7b9d4281c (git)
Linux	Linux	Affected: 2.6.26 Unaffected: 0 , < 2.6.26 (semver) Unaffected: 4.14.322 , ≤ 4.14.* (semver) Unaffected: 4.19.291 , ≤ 4.19.* (semver) Unaffected: 5.4.253 , ≤ 5.4.* (semver) Unaffected: 5.10.190 , ≤ 5.10.* (semver) Unaffected: 5.15.126 , ≤ 5.15.* (semver) Unaffected: 6.1.45 , ≤ 6.1.* (semver) Unaffected: 6.4.10 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53365",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:45:20.470480Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:53:01.715Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a96d74d1076c82a4cef02c150d9996b21354c78d",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            },
            {
              "lessThan": "8382e7ed2d63e6c2daf6881fa091526dc6c879cd",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            },
            {
              "lessThan": "0438e60a00d4e335b3c36397dbf26c74b5d13ef0",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            },
            {
              "lessThan": "1683124129a4263dd5bce2475bab110e95fa0346",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            },
            {
              "lessThan": "1bb54a21f4d9b88442f8c3307c780e2db64417e4",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            },
            {
              "lessThan": "691a09eecad97e745b9aa0e3918db46d020bdacb",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            },
            {
              "lessThan": "3326c711f18d18fe6e1f5d83d3a7eab07e5a1560",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            },
            {
              "lessThan": "30e0191b16e8a58e4620fa3e2839ddc7b9d4281c",
              "status": "affected",
              "version": "14fb64e1f449ef6666f1c3a3fa4e13aec669b98d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.322",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.126",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.322",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.291",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.253",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.190",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.126",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.45",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.10",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: Fix skb_under_panic in ip6mr_cache_report()\n\nskbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4\n head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg\n ------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:192!\n invalid opcode: 0000 [#1] PREEMPT SMP KASAN\n CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Workqueue: ipv6_addrconf addrconf_dad_work\n RIP: 0010:skb_panic+0x152/0x1d0\n Call Trace:\n  \u003cTASK\u003e\n  skb_push+0xc4/0xe0\n  ip6mr_cache_report+0xd69/0x19b0\n  reg_vif_xmit+0x406/0x690\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  vlan_dev_hard_start_xmit+0x3ab/0x5c0\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  neigh_connected_output+0x3ed/0x570\n  ip6_finish_output2+0x5b5/0x1950\n  ip6_finish_output+0x693/0x11c0\n  ip6_output+0x24b/0x880\n  NF_HOOK.constprop.0+0xfd/0x530\n  ndisc_send_skb+0x9db/0x1400\n  ndisc_send_rs+0x12a/0x6c0\n  addrconf_dad_completed+0x3c9/0xea0\n  addrconf_dad_work+0x849/0x1420\n  process_one_work+0xa22/0x16e0\n  worker_thread+0x679/0x10c0\n  ret_from_fork+0x28/0x60\n  ret_from_fork_asm+0x11/0x20\n\nWhen setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit().\nreg_vif_xmit()\n    ip6mr_cache_report()\n        skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4\nAnd skb_push declared as:\n\tvoid *skb_push(struct sk_buff *skb, unsigned int len);\n\t\tskb-\u003edata -= len;\n\t\t//0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850\nskb-\u003edata is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:43:32.333Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a96d74d1076c82a4cef02c150d9996b21354c78d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8382e7ed2d63e6c2daf6881fa091526dc6c879cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0438e60a00d4e335b3c36397dbf26c74b5d13ef0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1683124129a4263dd5bce2475bab110e95fa0346"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bb54a21f4d9b88442f8c3307c780e2db64417e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/691a09eecad97e745b9aa0e3918db46d020bdacb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3326c711f18d18fe6e1f5d83d3a7eab07e5a1560"
        },
        {
          "url": "https://git.kernel.org/stable/c/30e0191b16e8a58e4620fa3e2839ddc7b9d4281c"
        }
      ],
      "title": "ip6mr: Fix skb_under_panic in ip6mr_cache_report()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53365",
    "datePublished": "2025-09-17T14:56:53.781Z",
    "dateReserved": "2025-09-17T14:54:09.733Z",
    "dateUpdated": "2026-05-11T19:43:32.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38718 (GCVE-0-2025-38718)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:33 – Updated: 2026-08-05 12:04

Title

sctp: linearize cloned gso packets in sctp_rcv

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux mitre root Scorecard

References

10 references

URL	Tags
https://git.kernel.org/stable/c/d0194e391bb493aa6…
https://git.kernel.org/stable/c/03d0cc6889e024201…
https://git.kernel.org/stable/c/cd0e92bb2b7542fb9…
https://git.kernel.org/stable/c/4506bcaabe004d07b…
https://git.kernel.org/stable/c/ea094f38d387d1b0d…
https://git.kernel.org/stable/c/7d757f17bc2ef2727…
https://git.kernel.org/stable/c/fc66772607101bd20…
https://git.kernel.org/stable/c/1bd5214ea681584c5…
https://git.kernel.org/stable/c/fd60d8a086191fe33…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < d0194e391bb493aa6cec56d177b14df6b29188d5 (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < 03d0cc6889e02420125510b5444b570f4bbf53d5 (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < cd0e92bb2b7542fb96397ffac639b4f5b099d0cb (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < 4506bcaabe004d07be8ff09116a3024fbd6aa965 (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < ea094f38d387d1b0ded5dee4a3e5720aa4ce0139 (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < 7d757f17bc2ef2727994ffa6d5d6e4bc4789a770 (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < fc66772607101bd2030a4332b3bd0ea3b3605250 (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < 1bd5214ea681584c5886fea3ba03e49f93a43c0e (git) Affected: 90017accff61ae89283ad9a51f9ac46ca01633fb , < fd60d8a086191fe33c2d719732d2482052fa6805 (git)
Linux	Linux	Affected: 4.8 Unaffected: 0 , < 4.8 (semver) Unaffected: 5.4.297 , ≤ 5.4.* (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.162 , ≤ 6.1.* (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.43 , ≤ 6.12.* (semver) Unaffected: 6.15.11 , ≤ 6.15.* (semver) Unaffected: 6.16.2 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:48.713Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:36.204042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:03.458Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0194e391bb493aa6cec56d177b14df6b29188d5",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "03d0cc6889e02420125510b5444b570f4bbf53d5",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "cd0e92bb2b7542fb96397ffac639b4f5b099d0cb",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "4506bcaabe004d07be8ff09116a3024fbd6aa965",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "ea094f38d387d1b0ded5dee4a3e5720aa4ce0139",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "7d757f17bc2ef2727994ffa6d5d6e4bc4789a770",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "fc66772607101bd2030a4332b3bd0ea3b3605250",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "1bd5214ea681584c5886fea3ba03e49f93a43c0e",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "fd60d8a086191fe33c2d719732d2482052fa6805",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: linearize cloned gso packets in sctp_rcv\n\nA cloned head skb still shares these frag skbs in fraglist with the\noriginal head skb. It\u0027s not safe to access these frag skbs.\n\nsyzbot reported two use-of-uninitialized-memory bugs caused by this:\n\n  BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n   sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n   sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998\n   sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88\n   sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331\n   sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122\n   __release_sock+0x1da/0x330 net/core/sock.c:3106\n   release_sock+0x6b/0x250 net/core/sock.c:3660\n   sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360\n   sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885\n   sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031\n   inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851\n   sock_sendmsg_nosec net/socket.c:718 [inline]\n\nand\n\n  BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n   sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n   sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88\n   sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331\n   sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148\n   __release_sock+0x1d3/0x330 net/core/sock.c:3213\n   release_sock+0x6b/0x270 net/core/sock.c:3767\n   sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367\n   sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886\n   sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032\n   inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851\n   sock_sendmsg_nosec net/socket.c:712 [inline]\n\nThis patch fixes it by linearizing cloned gso packets in sctp_rcv()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable branch requires `skb_is_gso_sctp()`, and `SKB_GSO_SCTP` is set only by the local transmit path (`sk-\u003esk_gso_type` in net/sctp/socket.c:5042, applied in `sctp_packet_pack()`); net/sctp/offload.c registers no GRO handler and virtio/tun cannot carry an SCTP GSO type, so packets arriving from a real network are never `is_gso` and the attacker must originate the packet locally via `sendmsg()` on an SCTP socket looped back over `lo`/`veth`.\nAC:L - The attacker supplies every precondition: an SCTP socket sending more than PMTU to 127.0.0.1 to force the GSO cover-letter skb, and an AF_PACKET or raw socket to guarantee the clone via `dev_queue_xmit_nit()`, all repeatable in a loop; syzbot reproduced it independently twice.\nPR:L - No `capable()` check exists anywhere on the `sendmsg` \u2192 `sctp_packet_pack` \u2192 `sctp_rcv` \u2192 `sctp_inq_pop` path, the SCTP module autoloads on an unprivileged `socket(AF_INET, SOCK_SEQPACKET, IPPROTO_SCTP)`, and the CAP_NET_RAW needed for the cloning tap is obtainable by any local user with `unshare -Urn`.\nUI:N - The attacker performs the send, the clone setup, and the receive entirely from its own processes; no victim action or cooperation is involved.\nS:U - The out-of-bounds accesses and skb metadata corruption occur in kernel heap memory within the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - `sctp_inq_pop()` reads chunk headers past the frag skb\u0027s valid data (KMSAN uninit-value at inqueue.c:211), and the resulting attacker-influenced `chunk_end`/`datalen` drives `skb_trim()` in `sctp_ulpevent_make_rcvmsg()` on the clone queued for `recvmsg()`, while the co-owner of the shared frags (AF_PACKET/raw socket) reads them at pointers SCTP already advanced \u2014 both paths copy adjacent kernel heap out to userspace.\nI:H - SCTP mutates `data`, `len`, and `cb` of frag skbs concurrently owned by another subsystem, and `skb_pull(chunk-\u003eskb, sizeof(*ch))` on an already-consumed frag underflows `skb-\u003elen` to ~4 GB unchecked, leaving a corrupted length on a live skb while the full SCTP state machine executes on out-of-bounds bytes.\nA:H - The condition is a KASAN/KMSAN-reportable memory-safety violation whose ~4 GB `skb-\u003elen` underflow and out-of-range `skb_trim()` produce oops/panic in downstream copy and accounting paths, and any unprivileged local user can retrigger it in a loop."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:15.979Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0194e391bb493aa6cec56d177b14df6b29188d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/03d0cc6889e02420125510b5444b570f4bbf53d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd0e92bb2b7542fb96397ffac639b4f5b099d0cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/4506bcaabe004d07be8ff09116a3024fbd6aa965"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea094f38d387d1b0ded5dee4a3e5720aa4ce0139"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d757f17bc2ef2727994ffa6d5d6e4bc4789a770"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc66772607101bd2030a4332b3bd0ea3b3605250"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bd5214ea681584c5886fea3ba03e49f93a43c0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd60d8a086191fe33c2d719732d2482052fa6805"
        }
      ],
      "title": "sctp: linearize cloned gso packets in sctp_rcv",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38718",
    "datePublished": "2025-09-04T15:33:12.448Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:15.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:22910

BDU:2026-02276 (CVE-2023-53365)

CVE-2022-3640 (GCVE-0-2022-3640)

CVE-2022-50341 (GCVE-0-2022-50341)

CVE-2022-50386 (GCVE-0-2022-50386)

CVE-2022-50408 (GCVE-0-2022-50408)

CVE-2023-53305 (GCVE-0-2023-53305)

CVE-2023-53365 (GCVE-0-2023-53365)

CVE-2025-38718 (GCVE-0-2025-38718)

Tags

Sightings

Nomenclature

Related by attack behaviour