{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fdinfo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "950b604384fd75d62e860bec7135b2b62eb4d508",
              "status": "affected",
              "version": "a1a541fbfa7e97c1100144db34b57553d7164ce5",
              "versionType": "git"
            },
            {
              "lessThan": "bc1c6b803e14ea2b8f7e33b7164013f666ceb656",
              "status": "affected",
              "version": "f0c0ac84de17c37e6e84da65fb920f91dada55ad",
              "versionType": "git"
            },
            {
              "lessThan": "3f307a9f7a7a2822e38ac451b73e2244e7279496",
              "status": "affected",
              "version": "3c7c90274ae339e1ad443c9be1c67a20b80b9c76",
              "versionType": "git"
            },
            {
              "lessThan": "d1894bc542becb0fda61e7e513b09523cab44030",
              "status": "affected",
              "version": "c45beebfde34aa71afbc48b2c54cdda623515037",
              "versionType": "git"
            },
            {
              "lessThan": "a7c4bb43bfdc2b9f06ee9d036028ed13a83df42a",
              "status": "affected",
              "version": "c45beebfde34aa71afbc48b2c54cdda623515037",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.73",
              "status": "affected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.115",
              "status": "affected",
              "version": "6.6.74",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.56",
              "status": "affected",
              "version": "6.12.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fdinfo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.73",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.73",
                  "versionStartIncluding": "6.6.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.115",
                  "versionStartIncluding": "6.6.74",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.56",
                  "versionStartIncluding": "6.12.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/notify: call exportfs_encode_fid with s_umount\n\nCalling intotify_show_fdinfo() on fd watching an overlayfs inode, while\nthe overlayfs is being unmounted, can lead to dereferencing NULL ptr.\n\nThis issue was found by syzkaller.\n\nRace Condition Diagram:\n\nThread 1                           Thread 2\n--------                           --------\n\ngeneric_shutdown_super()\n shrink_dcache_for_umount\n  sb-\u003es_root = NULL\n\n                    |\n                    |             vfs_read()\n                    |              inotify_fdinfo()\n                    |               * inode get from mark *\n                    |               show_mark_fhandle(m, inode)\n                    |                exportfs_encode_fid(inode, ..)\n                    |                 ovl_encode_fh(inode, ..)\n                    |                  ovl_check_encode_origin(inode)\n                    |                   * deref i_sb-\u003es_root *\n                    |\n                    |\n                    v\n fsnotify_sb_delete(sb)\n\nWhich then leads to:\n\n[   32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[   32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none)\n\n\u003csnip registers, unreliable trace\u003e\n\n[   32.143353] Call Trace:\n[   32.143732]  ovl_encode_fh+0xd5/0x170\n[   32.144031]  exportfs_encode_inode_fh+0x12f/0x300\n[   32.144425]  show_mark_fhandle+0xbe/0x1f0\n[   32.145805]  inotify_fdinfo+0x226/0x2d0\n[   32.146442]  inotify_show_fdinfo+0x1c5/0x350\n[   32.147168]  seq_show+0x530/0x6f0\n[   32.147449]  seq_read_iter+0x503/0x12a0\n[   32.148419]  seq_read+0x31f/0x410\n[   32.150714]  vfs_read+0x1f0/0x9e0\n[   32.152297]  ksys_read+0x125/0x240\n\nIOW ovl_check_encode_origin derefs inode-\u003ei_sb-\u003es_root, after it was set\nto NULL in the unmount path.\n\nFix it by protecting calling exportfs_encode_fid() from\nshow_mark_fhandle() with s_umount lock.\n\nThis form of fix was suggested by Amir in [1].\n\n[1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:01:45.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/950b604384fd75d62e860bec7135b2b62eb4d508"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc1c6b803e14ea2b8f7e33b7164013f666ceb656"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f307a9f7a7a2822e38ac451b73e2244e7279496"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1894bc542becb0fda61e7e513b09523cab44030"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7c4bb43bfdc2b9f06ee9d036028ed13a83df42a"
        }
      ],
      "title": "fs/notify: call exportfs_encode_fid with s_umount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40237",
    "datePublished": "2025-12-04T15:31:27.325Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-05-23T16:01:45.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ioam6.h",
            "net/ipv6/exthdrs.c",
            "net/ipv6/ioam6.c",
            "net/ipv6/ioam6_iptunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f4d9d4b8fd839719d564651671e24c62c545c23b",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "fb3c662fafebc5b9d74417ed1de8759f6bb72143",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "632d233cf2e64a46865ae2c064ae3c9df7c8864f",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "0591d6509c2ff13f09ea2998434aba0c0472e978",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "e90346a2f1e8917d5760a44a1f61c44e3b36d96b",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "ea3632aefc04205436868541638e26f4a74d5637",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            },
            {
              "lessThan": "6db8b56eed62baacaf37486e83378a72635c04cc",
              "status": "affected",
              "version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ioam6.h",
            "net/ipv6/exthdrs.c",
            "net/ipv6/ioam6.c",
            "net/ipv6/ioam6_iptunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace-\u003enodelen\nto decide how much data to write for each node. It trusts this field\nas-is from the incoming packet, with no consistency check against\ntrace-\u003etype (the 24-bit field that tells which data items are\npresent). A crafted packet can set nodelen=0 while setting type bits\n0-21, causing the function to write ~100 bytes past the allocated\nregion (into skb_shared_info), which corrupts adjacent heap memory\nand leads to a kernel panic.\n\nAdd a shared helper ioam6_trace_compute_nodelen() in ioam6.c to\nderive the expected nodelen from the type field, and use it:\n\n  - in ioam6_iptunnel.c (send path, existing validation) to replace\n    the open-coded computation;\n  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose\n    nodelen is inconsistent with the type field, before any data is\n    written.\n\nPer RFC 9197, bits 12-21 are each short (4-octet) fields, so they\nare included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to\n0xff1ffc00)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is reached while processing received IPv6 Hop-by-Hop IOAM options in the network stack. A remote packet sender can craft the IOAM trace header for an IOAM-enabled target.\nAC:L - Exploitation requires a malformed but straightforward IOAM Pre-allocated Trace option with inconsistent nodelen and type fields. There is no race or attacker-uncontrolled timing condition once IOAM is enabled on the target interface.\nPR:N - The packet processing path has no authentication or per-sender privilege check before calling the vulnerable fill routine. Although enabling IOAM and creating namespaces is administrative setup, a remote attacker against such a deployment needs no privileges.\nUI:N - No victim user action is needed. The vulnerable path runs automatically when the kernel receives and parses the crafted IPv6 packet.\nS:U - The corruption occurs inside the same kernel security authority that processes the packet. This is not a VM escape or other cross-scope boundary bypass.\nC:H - The bug is a kernel heap out-of-bounds write into adjacent skb memory, including skb_shared_info in the described case. Such memory corruption can be leveraged for kernel memory disclosure as part of exploitation.\nI:H - This is an out-of-bounds kernel heap write controlled by attacker-supplied packet fields and layout choices. Kernel heap corruption is defensibly exploitable for arbitrary modification or code execution.\nA:H - The fix commit states the corruption leads to a kernel panic, and malformed packets can be sent repeatedly. Kernel panic or crash is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:24.342Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f4d9d4b8fd839719d564651671e24c62c545c23b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb3c662fafebc5b9d74417ed1de8759f6bb72143"
        },
        {
          "url": "https://git.kernel.org/stable/c/632d233cf2e64a46865ae2c064ae3c9df7c8864f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0591d6509c2ff13f09ea2998434aba0c0472e978"
        },
        {
          "url": "https://git.kernel.org/stable/c/e90346a2f1e8917d5760a44a1f61c44e3b36d96b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea3632aefc04205436868541638e26f4a74d5637"
        },
        {
          "url": "https://git.kernel.org/stable/c/6db8b56eed62baacaf37486e83378a72635c04cc"
        }
      ],
      "title": "ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43186",
    "datePublished": "2026-05-06T11:27:57.053Z",
    "dateReserved": "2026-05-01T14:12:55.991Z",
    "dateUpdated": "2026-08-05T12:26:24.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad3c0c4400686f6f37b382aaa48fac2b9aefccbe",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "68013a9bd4c01acd42073715f00e1a1992f089ee",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "e8474cfbac9ada2cdaa4eaedec22aadfa0f58559",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "058b451b1039f056d1362c4fec2229e522366ab0",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "b5597bb83fc37b5b5da74a4453fa920b932cf39a",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "08fa5d818e5bf53c7ca234d88ba334f32004e9b6",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "08841b06fa64d8edbd1a21ca6e613420c90cc4b8",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7f401f160a9c7a1ff84ba3cb9b2f636d1f5cfb6b",
              "versionType": "git"
            },
            {
              "lessThan": "4.19",
              "status": "affected",
              "version": "4.18.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.18.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: fix partition descriptor append bookkeeping\n\nMounting a crafted UDF image with repeated partition descriptors can\ntrigger a heap out-of-bounds write in part_descs_loc[].\n\nhandle_partition_descriptor() deduplicates entries by partition number,\nbut appended slots never record partnum. As a result duplicate\nPartition Descriptors are appended repeatedly and num_part_descs keeps\ngrowing.\n\nOnce the table is full, the growth path still sizes the allocation from\npartnum even though inserts are indexed by num_part_descs. If partnum is\nalready aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep\nthe old capacity and the next append writes past the end of the table.\n\nStore partnum in the appended slot and size growth from the next append\ncount so deduplication and capacity tracking follow the same model."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in mount-time on-disk parsing, reachable locally via loop-device mounts or removable-media handling (e.g. udisks2), not over any network protocol.\nAC:L - The out-of-bounds write is deterministic for a crafted image with repeated partition descriptors at a 32-aligned partnum; no race or attacker-uncontrollable condition is involved.\nPR:L - Direct mount needs CAP_SYS_ADMIN, but on typical workstations/kiosks an unprivileged local user can get a crafted UDF image mounted through privileged auto-mount/udisks2 helpers, so low privilege suffices.\nUI:N - The attacker supplies and triggers the mount of their own crafted image; no action by a separate victim user is required.\nS:U - The corruption stays within the kernel\u0027s own security authority; there is no cross-boundary (VM/IOMMU) escape.\nC:H - A controlled heap out-of-bounds write corrupts adjacent heap objects and can be leveraged (e.g. corrupting length/pointer fields) into an arbitrary read and information disclosure.\nI:H - The bug is a heap out-of-bounds write of attacker-influenced values at attacker-reachable offsets \u2014 a write primitive exploitable for further corruption and control-flow hijack.\nA:H - Heap metadata/object corruption from the out-of-bounds write reliably leads to a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:03.928Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad3c0c4400686f6f37b382aaa48fac2b9aefccbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/68013a9bd4c01acd42073715f00e1a1992f089ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8474cfbac9ada2cdaa4eaedec22aadfa0f58559"
        },
        {
          "url": "https://git.kernel.org/stable/c/058b451b1039f056d1362c4fec2229e522366ab0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5597bb83fc37b5b5da74a4453fa920b932cf39a"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fa5d818e5bf53c7ca234d88ba334f32004e9b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/08841b06fa64d8edbd1a21ca6e613420c90cc4b8"
        }
      ],
      "title": "udf: fix partition descriptor append bookkeeping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45991",
    "datePublished": "2026-05-27T12:55:43.449Z",
    "dateReserved": "2026-05-13T15:03:33.091Z",
    "dateUpdated": "2026-08-05T12:29:03.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.158.1.rt7.499.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.158.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.42.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending specially crafted SCTP packets. This could lead to a system crash, causing a Denial of Service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:22.929Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-52924"
          },
          {
            "name": "RHBZ#2492095",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67471"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59723"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59821"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59737"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:67471: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59723: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59821: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59737: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84b7a319105db2f917ccdcf502bdc866082b1285",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "3c0741a441a7df7099d7ca6a64a6a0de09c677c8",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "2afc9e684dc7fecf73db1edc937ebbc47b4b68dc",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "1d4652f677906a64487c13f9ace54b0eb263b5d0",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "a6207349e703cfc04756a4d16dec9176135813a5",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "83ade59e5da365f4bf8bce72c5a38774202b442f",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "e374b22e9b07b72a25909621464ff74096151bfb",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n  BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n  Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n  CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n     7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n   sctp_sched_fcfs_dequeue+0x13a/0x140\n   sctp_outq_flush+0x1603/0x33e0\n   sctp_do_sm+0x31c9/0x5d30\n   sctp_assoc_bh_rcv+0x392/0x6f0\n   sctp_inq_push+0x1db/0x270\n   sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable SCTP state-machine path is reached by received SCTP packets, specifically an ERROR chunk with a Stale Cookie cause sent by the remote SCTP peer during COOKIE_ECHOED handling.\nAC:L - A malicious SCTP peer can drive the required handshake state and send the stale-cookie ERROR; no race or hard-to-control kernel condition is required once data has been queued for COOKIE-ECHO bundling.\nPR:N - The triggering packet is accepted from the network after SCTP verification-tag checks, but those are protocol state checks rather than authentication or privileges. No local account or administrative capability is required for a remote peer.\nUI:N - Exploitation does not require a human user action; it can occur during normal SCTP association setup and data transmission with a malicious peer.\nS:U - The impact is within the Linux kernel networking stack on the same system and does not cross a separate security authority such as a hypervisor or sandbox boundary.\nC:H - The bug leaves stream-\u003eout_curr pointing at freed stream state, creating a use-after-free in scheduler dequeue paths. Per kernel CVSS guidance, use-after-free memory corruption can be leveraged for high confidentiality impact.\nI:H - The stale pointer use-after-free is kernel heap memory corruption and may be exploitable beyond a crash via heap manipulation. Per the required guidance, UAFs warrant high integrity impact.\nA:H - The reported failure is a KASAN slab-use-after-free in SCTP dequeue leading to a kernel crash/oops. This provides high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:45.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285"
        },
        {
          "url": "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb"
        }
      ],
      "title": "sctp: purge outqueue on stale COOKIE-ECHO handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52924",
    "datePublished": "2026-06-24T07:14:18.646Z",
    "dateReserved": "2026-06-09T07:44:35.368Z",
    "dateUpdated": "2026-09-15T12:04:22.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9902a1058992de5d95656b64a3bd95c077f7ba2c",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "d3019c61799adc21811af4b521f11f3dc77f8e04",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "dd206819f210522579010d889d45a9530bb494bc",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "af2c22ccb1f621aff487ff47a040e38e058541e7",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "c7f945f7da097245a2f8ed7775ce48421047ee96",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "f0fea2b6d5453a11ad11713bbf37561b9b3a7edf",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "a91887a5b6ee4b98dfbf1db657ed2b879430149e",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "92170e6afe927ab2792a3f71902845789c8e31b1",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller\u0027s on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead.  After\nthat point the cached th is stale:\n\n    caller (ipv[46]_synproxy_hook)\n      th = skb_header_pointer(skb, ..., \u0026_tcph)\n      synproxy_tstamp_adjust(skb, protoff, th, ...)\n        skb_ensure_writable(skb, optend)\n          pskb_expand_head()        /* kfree(old skb-\u003ehead) */\n        ...\n        inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n                                    /* writes into freed head, or\n                                       into the caller\u0027s stack copy\n                                       leaving the on-wire checksum\n                                       stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace.  The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:06.995Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"
        },
        {
          "url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"
        }
      ],
      "title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64007",
    "datePublished": "2026-07-19T14:56:23.049Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-08-05T12:38:06.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6e27f40b682a5e42a2daae3ce6d96f0e0e16dedb",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "878757163eea684750107a31ea134c103863515d",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "3407240cde132a4b72d6429a2625a09a2f78adaf",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "013a9a3da46c5dabcf18f65ea6a47874ba12a15d",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_flush() replay\n\nSMB2_flush() keeps its response buffer bookkeeping across replay\nattempts. If a replayable flush response is received and the retry then\nfails before cifs_send_recv() stores a replacement response, flush_exit\nwill free the stale response pointer a second time.\n\nReinitialize resp_buftype and rsp_iov at the top of the replay loop so\ncleanup only acts on response state produced by the current attempt.\nThis fixes a double-free without changing replay handling for successful\nrequests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB server can trigger the flaw through crafted replayable responses and connection failures over the network.\nAC:L - The server controls both the replayable error and subsequent reconnect failure, allowing repeated triggering without an uncontrollable race.\nPR:N - The attacking SMB endpoint requires no privileges on the client system once an SMB session and file handle exist.\nUI:N - An automatically mounted share and routine service-generated fsync, truncate, timestamp, or seek operations can reach SMB2_flush() without human participation.\nS:U - The memory corruption compromises resources governed by the same host kernel security authority.\nC:H - The response-buffer double-free can create overlapping CIFS slab allocations and use-after-free primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and attacker-influenced overlapping network buffers can provide arbitrary-write or control-flow-hijacking primitives.\nA:H - The double-free can immediately trigger an allocator BUG, kernel oops, or panic and can be invoked repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:35.045Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6e27f40b682a5e42a2daae3ce6d96f0e0e16dedb"
        },
        {
          "url": "https://git.kernel.org/stable/c/878757163eea684750107a31ea134c103863515d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3407240cde132a4b72d6429a2625a09a2f78adaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/013a9a3da46c5dabcf18f65ea6a47874ba12a15d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_flush() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64383",
    "datePublished": "2026-07-25T08:50:32.634Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:35.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0be4bc64882edaefaaee8d1e27d083643eb778e6",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "96fcfc8ae7359346156e492ca610e830d2649ad6",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "276c8efbc49f9303ac76d0d4deab7128581b0f3b",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "fc65ffb4ef1bf540da16b17c225ae51091e07d72",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_ioctl() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_ioctl_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel\u0027s periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:37.258Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6"
        },
        {
          "url": "https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_ioctl() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64385",
    "datePublished": "2026-07-25T08:50:33.997Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:37.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "100fb7c455fa86d248b8bd7bb9de757c192870b4",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "3c81dda84799f76b42aec598564316e2964440db",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "f1add4acb656f5a82806a1ab0e63fed3d8b1bfca",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "89234773e8348918111aa15f6922b58cf3843364",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "2a88561d66eb855813cf004a0abe648bbb17de5e",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query_info() replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_info_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:38.353Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca"
        },
        {
          "url": "https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e"
        }
      ],
      "title": "smb: client: fix query_info() replay double-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64386",
    "datePublished": "2026-07-25T08:50:34.729Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:38.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a733a38b983d8c2e222f13968209010cf44de87",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "19d89b13a43640b2da2f277ee462d919d988cb6f",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "b3df61bb745eb5201eac22679a2839d4ccbf3442",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "1ae134c012e10384cdac420b5cc6e0615cde0b55",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "5161e67c561c4f28a5d9335a6e859b02511de92b",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "64d322c288577793eedd352b96ef75234ed380fe",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "588d4a6795d99d080f74ef0b5f391ea8c453ae5d",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "d0f86fb36eb260abd10007b62c9dcc1028e03e61",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u003ehead,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote peers reach __skb_udp_tunnel_segment on egress when GRO-coalesced VXLAN/Geneve/FOU GSO superpackets are forwarded or re-encapsulated through dev_queue_xmit, and malicious virtio-net/cloud tenants can inject VIRTIO_NET_HDR_GSO_UDP_TUNNEL frames the host later segments on physical or overlay NICs.\nAC:L - Triggering is deterministic once a GSO UDP-tunnel skb has tunnel headers beyond skb_headlen so pskb_may_pull reallocates skb-\u003ehead; attackers control that layout via fragmented or GRO-built outer/encap headers and can repeat crafted sends until segmentation dereferences the stale UDP pointer.\nPR:N - No host authentication or credentials are required to send UDP tunnel traffic to listening overlay ports on cloud/DC nodes, and co-resident virtio-net guests or tenant VMs can emit GSO UDP-tunnel frames into the host datapath without CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation needs only crafted encapsulated GSO traffic into an already-running overlay, bridge, IPVS, OVS, or virtio forwarding path; no victim file open, mount, link click, or other interactive action beyond normal network or VM I/O.\nS:C - In cloud/Kubernetes and virtio-net multitenant deployments, remote or guest/tenant senders can corrupt hypervisor kernel heap during host-side UDP-tunnel GSO segmentation on egress, crossing the VM/container-to-host security boundary rather than staying within the attacker\u0027s own namespace.\nC:H - After pskb_may_pull reallocates skb-\u003ehead, the pre-pull udp_hdr pointer is stale yet uh-\u003elen and uh-\u003echeck are read for checksum adjustment, yielding a classic heap use-after-free read primitive that can disclose kernel memory and support further exploitation.\nI:H - UAF on the UDP header allows attacker-influenced heap reuse and corruption of header fields and checksum state during tunnel GSO segmentation, providing a write/control primitive suitable for kernel code execution rather than a benign checksum miscalculation.\nA:H - Dereferencing the freed UDP header during GSO segmentation can immediately oops or panic the kernel, and repeated exploitation attempts against this UAF commonly crash or hang the host even when full control is not achieved."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:48.767Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55"
        },
        {
          "url": "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b"
        },
        {
          "url": "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61"
        }
      ],
      "title": "udp: fix potential use-after-free in tunnel segmentation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74705",
    "datePublished": "2026-08-22T15:33:04.110Z",
    "dateReserved": "2026-08-15T05:44:03.927Z",
    "dateUpdated": "2026-08-25T05:41:48.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b6c2842692d08e7acaf32d1eb47f95def35f3fe",
              "status": "affected",
              "version": "5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a",
              "versionType": "git"
            },
            {
              "lessThan": "6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33",
              "status": "affected",
              "version": "de7921631ff323369aa63a4324695ab54ea4047e",
              "versionType": "git"
            },
            {
              "lessThan": "1293fd69a50d188a5788b08ba3741a3e86be1608",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "fe198b077864feafd4aa4b33b1a5ce26f50195a2",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "e3702470ced94fad74d71e2232f022d2eb752a6d",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "594d905195024b228c962627ae5ae7c17bd582a4",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.189",
              "status": "affected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "6.6.93",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "6.1.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.6.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n   1) Create two SCCs:\n\n       X -.   A \u003c-\u003e B\n       ^--\u0027\n\n   2) Run the following concurrently:\n\n      2-1) send() sk-B to sk-B from sk-X\n      2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\n\n       X -.   A \u003c-\u003e B -. This edge is visible\n       ^--\u0027         ^..\u0027  but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n       X -.   A \u003c.\u003e B -.\n       ^--\u0027         ^--\u0027\n\nHowever, X\u0027s SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B\u0027s scc_entry.\n\nLet\u0027s unlink scc_entry before freeing the vertex in unix_del_edge()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable through local AF_UNIX syscalls (socket/sendmsg with SCM_RIGHTS and close) that drive unix_add_edges(), unix_del_edge(), and unix_gc(); AF_UNIX is host-local IPC with no remote packet, Bluetooth, WiFi, or physical bus entry path.\nAC:L - Exploitation requires racing sendmsg() (scm_stat_add/unix_add_edges before skb_queue_tail) against concurrent close() that triggers GC; the attacker controls both threads, can pin CPUs, and can retry until the window is hit, so success does not depend on conditions outside attacker control.\nPR:L - An unprivileged local user can create AF_UNIX sockets, pass socket file descriptors via SCM_RIGHTS to form inflight reference cycles, and close sockets to schedule unix_gc(); no real-root capabilities, special namespaces, or non-default kernel configuration are required.\nUI:N - The attacker sets up the cyclic inflight graph, performs the concurrent self-send and close operations, and forces garbage collection from its own processes; no separate victim user action or cooperating peer is needed beyond the attacker\u0027s own sockets.\nS:U - The use-after-free corrupts kernel heap/list state during AF_UNIX garbage collection within the same kernel security authority; exploitation yields standard local privilege escalation rather than crossing a VM, IOMMU, or inter-tenant sandbox boundary.\nC:H - Freed struct unix_vertex objects remain linked through stale scc_entry; unix_walk_scc_fast(), unix_scc_dead(), and unix_collect_skb() dereference freed vertex-\u003eedges and predecessor socket receive queues, giving a slab UAF read primitive controllable through heap grooming.\nI:H - The same UAF enables reclaiming freed vertices and influencing GC list iteration and skb_queue_splice_init() during unix_collect_skb(), providing memory corruption primitives suitable for arbitrary kernel writes, control-flow hijack, and local privilege escalation.\nA:H - Iterating or collecting through a freed vertex reliably triggers kernel oops/panic (KASAN slab-use-after-free), and corrupt GC graph state can crash the host or deny service to local workloads even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:56:06.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b6c2842692d08e7acaf32d1eb47f95def35f3fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33"
        },
        {
          "url": "https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"
        }
      ],
      "title": "af_unix: Unlink scc_entry in unix_del_edge().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80521",
    "datePublished": "2026-08-26T14:37:02.589Z",
    "dateReserved": "2026-08-26T14:34:25.763Z",
    "dateUpdated": "2026-10-03T10:56:06.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}