{"resultsPerPage":153,"startIndex":0,"totalResults":153,"format":"NVD_CVE","version":"2.0","timestamp":"2026-07-27T11:57:56.631","vulnerabilities":[{"cve":{"id":"CVE-2026-64188","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-20T17:18:21.853","lastModified":"2026-07-27T05:16:34.730","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()\n\nrmnet_dellink() removes the endpoint from the hash table with\nhlist_del_init_rcu() and then immediately frees it with kfree(). However,\nRCU readers on the receive path (rmnet_rx_handler ->\n__rmnet_map_ingress_handler) may still hold a reference to the endpoint and\ndereference ep->egress_dev after the memory has been freed. The endpoint is\na kmalloc-32 object, and the stale read at offset 8 corresponds to the\negress_dev pointer.\n\n  BUG: unable to handle page fault for address: ffffffffde942eef\n  Oops: 0002 [#1] SMP NOPTI\n  CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY\n  RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27)\n  Call Trace:\n   <TASK>\n   __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101)\n   rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235)\n   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096)\n   __netif_receive_skb_one_core (net/core/dev.c:6208)\n   netif_receive_skb (net/core/dev.c:6467)\n   tun_get_user (drivers/net/tun.c:1955)\n   tun_chr_write_iter (drivers/net/tun.c:2003)\n   vfs_write (fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)\n   </TASK>\n\nAdd an rcu_head field to struct rmnet_endpoint and replace kfree() with\nkfree_rcu() so the endpoint memory remains valid through the RCU grace\nperiod. Also remove the rmnet_vnd_dellink() call and inline only the\nnr_rmnet_devs decrement, since rmnet_vnd_dellink() would set\nep->egress_dev to NULL during the grace period, creating a data race\nwith lockless readers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c","drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"c4e676c3505c5058922dc1a6f1ded795f6758135","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"9918698cf3aee4032e12bb42fd5a951dc465339b","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"310b93246bfec7d4452507e0c15477377ed9f025","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"1078ae8175777e80c9637996fb4a46c55f0ce576","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"41e06fcc5df0774d212e70c5b503fc769492bce3","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"8b17adf6d4fb6bf61fa4c3f58366a7c082799a71","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"f193e38cb257d033060b63f1cfd94af076b3a2ab","versionType":"git","status":"affected"},{"version":"ceed73a2cf4aff2921802aa3d21d45280677547d","lessThan":"d00c953a8f69921f484b629801766da68f27f658","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c","drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.260","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.211","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.177","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.37","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.14","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1078ae8175777e80c9637996fb4a46c55f0ce576","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/310b93246bfec7d4452507e0c15477377ed9f025","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41e06fcc5df0774d212e70c5b503fc769492bce3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b17adf6d4fb6bf61fa4c3f58366a7c082799a71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9918698cf3aee4032e12bb42fd5a951dc465339b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4e676c3505c5058922dc1a6f1ded795f6758135","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d00c953a8f69921f484b629801766da68f27f658","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f193e38cb257d033060b63f1cfd94af076b3a2ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64189","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-20T17:18:21.997","lastModified":"2026-07-27T05:16:34.970","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix race between dump and ip_set_list resize\n\nThe release path of ip_set_dump_do() and ip_set_dump_done() read\ninst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()\nof the array pointer. These run from netlink_recvmsg() without the nfnl\nmutex and without an RCU read-side critical section.\n\nA concurrent ip_set_create() can grow the array: it publishes the new\narray, calls synchronize_net() and then kvfree()s the old one. Since the\ndump paths read the array outside any RCU reader, synchronize_net() does\nnot wait for them and the old array can be freed while they still index\ninto it, causing a use-after-free.\n\nThe dumped set itself stays pinned via set->ref_netlink, so only the\narray load needs protecting. Take rcu_read_lock() around it, matching\nip_set_get_byname() and __ip_set_put_byindex().\n\n  BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n  Read of size 8 at addr ffff88800b5c4018 by task exploit/150\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n   netlink_dump (net/netlink/af_netlink.c:2325)\n   netlink_recvmsg (net/netlink/af_netlink.c:1976)\n   sock_recvmsg (net/socket.c:1159)\n   __sys_recvfrom (net/socket.c:2315)\n   ...\n  Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI\n  KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]\n  RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)\n  Kernel panic - not syncing: Fatal exception"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/ipset/ip_set_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"a7a299277959683204d73333c32c092fd69327d4","versionType":"git","status":"affected"},{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"1bc67c3fc98e9fc07032cc56afcdbc690c47d11e","versionType":"git","status":"affected"},{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710","versionType":"git","status":"affected"},{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"96fbafc20ebd9a613736c2998b89c539fe3042f5","versionType":"git","status":"affected"},{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"ff86ea9b7fdf70564e60436fbee68c96bc459943","versionType":"git","status":"affected"},{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"81d54c766337b923eec26da0a13406760b091093","versionType":"git","status":"affected"},{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"e8ee198bbc04a32d336e79160fde980e0235b39f","versionType":"git","status":"affected"},{"version":"8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7","lessThan":"7cd9103283b26b917360ec99d7d2f2d761bcf1ab","versionType":"git","status":"affected"},{"version":"2f6bf7917f55f9dae913193e49672b3598620eab","versionType":"git","status":"affected"},{"version":"4.19.5","lessThan":"4.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/ipset/ip_set_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1bc67c3fc98e9fc07032cc56afcdbc690c47d11e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cd9103283b26b917360ec99d7d2f2d761bcf1ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81d54c766337b923eec26da0a13406760b091093","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96fbafc20ebd9a613736c2998b89c539fe3042f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7a299277959683204d73333c32c092fd69327d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8ee198bbc04a32d336e79160fde980e0235b39f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff86ea9b7fdf70564e60436fbee68c96bc459943","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64191","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-20T17:18:22.217","lastModified":"2026-07-27T05:16:35.123","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip->words[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n  <TASK>\n  stub_xfer (drivers/i2c/i2c-stub.c:223)\n  __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n  i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n  i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n  i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n  __x64_sys_ioctl (fs/ioctl.c:583)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data->block[0] == 0 or\ndata->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/i2c-stub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"7e9072dbd5f2f17934751873450d2c22080ead80","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"21e87f336ac6303fed54a69b1d0d79a23b25c8d0","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"3fd225f3e4cd67ec8ddab1afed9da03c7c43537c","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"1c4ffe6b4f04365485ed58d64c9bb86b46fc9037","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"4bd8635f28c135a08aac6badcd7d9b5cdb34335f","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"5f4d2bd028ebb6e4c09a9d64842546022321d4a7","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"0526931b16e5a118d367b7bfce7d797e63f7ac69","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/i2c-stub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.260","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.211","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.177","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.37","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.14","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64206","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-20T17:18:22.620","lastModified":"2026-07-27T05:16:35.290","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: cancel pending_rx_work before taking conn->lock\n\nl2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for\npending_rx_work.  process_pending_rx() takes the same mutex, so teardown\ncan deadlock against the worker it is flushing.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the l2cap_conn_ready() -> queue_work(...,\n&conn->pending_rx_work) submit path, the l2cap_conn_del() ->\ncancel_work_sync(&conn->pending_rx_work) teardown path, and the\nprocess_pending_rx() -> mutex_lock(&conn->lock) worker edge.  Lockdep\n\n  WARNING: possible circular locking dependency detected\n  process_pending_rx+0x21/0x2a [vuln_msv]\n  l2cap_conn_del.constprop.0+0x3f/0x4e [vuln_msv]\n  *** DEADLOCK ***\n\nCancel pending_rx_work before taking conn->lock, matching the existing\nlock-before-drain ordering used for the two delayed works in the same\nteardown path.  The pending_rx queue is still purged after the work has\nbeen cancelled and conn->lock has been acquired."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"fc0c3b9cf27cfa2a06f66dae1d08c668fe0a2faa","versionType":"git","status":"affected"},{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"9901f847a762a5d953871dd95767ce2aed3d684d","versionType":"git","status":"affected"},{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"4a0bb0fd63fe2b0c62e1072cd1811d6f61e0081c","versionType":"git","status":"affected"},{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"8daaf7f73fe998631a160d1a5a7e1b0b0480eef8","versionType":"git","status":"affected"},{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"8de7b386ffad480ca59222b688c94a2da8f0d805","versionType":"git","status":"affected"},{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"d5616beb3355b5fca2280d796c1cf7ada4ee6551","versionType":"git","status":"affected"},{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"e96fbac8d3a73b0bc165383c092a30628561d320","versionType":"git","status":"affected"},{"version":"7ab56c3a6eccb215034b0cb096e0313441cbf2a4","lessThan":"2641a9e0a1dd4af2e21995470a21d55dd35e5203","versionType":"git","status":"affected"},{"version":"ee805f9499ebd0edf0877990968543c752043b59","versionType":"git","status":"affected"},{"version":"3.15.5","lessThan":"3.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.16","status":"affected"},{"version":"0","lessThan":"3.16","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2641a9e0a1dd4af2e21995470a21d55dd35e5203","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a0bb0fd63fe2b0c62e1072cd1811d6f61e0081c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8daaf7f73fe998631a160d1a5a7e1b0b0480eef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8de7b386ffad480ca59222b688c94a2da8f0d805","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9901f847a762a5d953871dd95767ce2aed3d684d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5616beb3355b5fca2280d796c1cf7ada4ee6551","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e96fbac8d3a73b0bc165383c092a30628561d320","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc0c3b9cf27cfa2a06f66dae1d08c668fe0a2faa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64600","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-23T06:16:50.493","lastModified":"2026-07-27T05:16:56.870","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping.  Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK.  Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don't refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping.  Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/xfs_reflink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5","lessThan":"dc11be133efca5fe3a2fb02b016dee825cc12f18","versionType":"git","status":"affected"},{"version":"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5","lessThan":"b8c9aa832b52680ee40d6cab0efb081f9a69df05","versionType":"git","status":"affected"},{"version":"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5","lessThan":"50f0012da1040f69a4e788cd9aed587c9a04983f","versionType":"git","status":"affected"},{"version":"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5","lessThan":"e705d81a7193dd19e69b8e2bad4696d78a4ea075","versionType":"git","status":"affected"},{"version":"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5","lessThan":"206c09b04dc5469c7ff14d8aceff2d47c88078d9","versionType":"git","status":"affected"},{"version":"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5","lessThan":"44f891bc088958399eec27f7604928694aa35581","versionType":"git","status":"affected"},{"version":"3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5","lessThan":"2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/xfs_reflink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc4","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/22/14","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/22/18","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/22/19","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-64208","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:48.420","lastModified":"2026-07-27T05:16:35.437","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks\n\nChange the krb5 crypto library to provide facilities to precheck the length\nof the message about to be decrypted or verified.\n\nFix AF_RXRPC to make use of this to validate DATA packets secured with\nRxGK."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/crypto/krb5.rst","crypto/krb5/krb5_api.c","include/crypto/krb5.h","include/trace/events/rxrpc.h","net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","lessThan":"585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff","versionType":"git","status":"affected"},{"version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","lessThan":"9217017f4bce53dddb8d547837f1f707045d64ad","versionType":"git","status":"affected"},{"version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","lessThan":"2b50aceafe6606ea52ed42aadd1b4d44a188aade","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/crypto/krb5.rst","crypto/krb5/krb5_api.c","include/crypto/krb5.h","include/trace/events/rxrpc.h","net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/2b50aceafe6606ea52ed42aadd1b4d44a188aade","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9217017f4bce53dddb8d547837f1f707045d64ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64210","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:48.623","lastModified":"2026-07-27T05:16:35.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: xsk: Fix unlocked writing to ICOSQ\n\nDuring napi poll, when the affinity changes and there's still XSK work\nto be done, we trigger an ICOSQ interrupt on the new CPU. However, this\ntriggering on the ICOSQ is done unprotected.\n\nThere are 2 such races:\n\nA) mlx5e_trigger_irq() is called while mlx5e_xsk_alloc_rx_mpwqe() is\nrunning from a different CPU due to affinity change. This can happen\nbecause IRQ triggering is done after napi_complete_done(). At this point\nthe NAPI can be scheduled on a different CPU. Like this:\n\n  CPU A (old affinity, NAPI tail)    CPU B (new affinity, fresh NAPI)\n  -------------------------------    --------------------------------\n  napi_complete_done()  clears SCHED\n  mlx5e_cq_arm(...)\n                                     napi_schedule_prep() sets SCHED\n                                     mlx5e_napi_poll()\n                                       mlx5e_xsk_alloc_rx_mpwqe()\n                                         mlx5e_icosq_sync_lock() // noop\n                                         memcpy 640 B UMR body\n                                         advance sq->pc by 10\n  mlx5e_trigger_irq(&c->icosq)\n    wqe_info[pi] = {NOP, 1}\n    mlx5e_post_nop() advances sq->pc\n\nB) mlx5e_trigger_irq() is called on the ICOSQ when\nmlx5e_trigger_napi_icosq() is running.\n\nThe obvious fix would be to lock the ICOSQ. But ICOSQ has an optimized\nlocking scheme that doesn't work for this scenario. Kick the async ICOSQ\ninstead which is always locked.\n\nThis issue was noticed in the wild with the following splat:\n\n  netdevice: ge-0-0-1: Bad OP in ICOSQ CQE: 0xd\n  WARNING: drivers/net/ethernet/mellanox/mlx5/core/en_rx.c:826 [...]\n  [...]\n  Call Trace:\n   <IRQ>\n   mlx5e_napi_poll+0x11d/0x7f0 [mlx5_core]\n   __napi_poll+0x30/0x200\n   ? skb_defer_free_flush+0x9c/0xc0\n   net_rx_action+0x2fe/0x3f0\n   handle_softirqs+0xd8/0x340\n   __irq_exit_rcu+0xbc/0xe0\n   common_interrupt+0x85/0xa0\n   </IRQ>\n   <TASK>\n   asm_common_interrupt+0x26/0x40\n  [...]\n  ---[ end trace 0000000000000000 ]---\n  mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2022, qn 0x8f4,\n  opcode 0xd, syndrome 0x2, vendor syndrome 0x68\n  00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  00000030: 00 00 00 00 01 00 68 02 01 00 08 f4 de 14 59 d2\n  WQE DUMP: WQ size 16384 WQ cur size 0, WQE index 0x1e14, len: 64\n  00000000: 00 00 00 01 d9 ed 80 02 00 00 00 01 d9 ed 90 02\n  00000010: 00 00 00 01 d9 ed a0 02 00 00 00 01 d9 ed b0 02\n  00000020: 00 00 00 01 d9 ed c0 02 00 00 00 01 d9 ed d0 02\n  00000030: 00 00 00 01 d9 ed e0 02 00 00 00 01 d9 ed f0 02\n  mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2023, qn 0x8f4,\n  opcode 0xd, syndrome 0x5, vendor syndrome 0xf9\n  00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  00000030: 00 00 00 00 01 00 f9 05 01 00 08 f4 de 15 cf d2"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"db05815b36cbd486c86fd002dfa81c9af6245e25","lessThan":"8d3b91e7d81000d295cd914d4d9d6f860252e2bf","versionType":"git","status":"affected"},{"version":"db05815b36cbd486c86fd002dfa81c9af6245e25","lessThan":"c326f9c68921e2f14dfcecb2f6b4216313d50248","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/8d3b91e7d81000d295cd914d4d9d6f860252e2bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c326f9c68921e2f14dfcecb2f6b4216313d50248","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64216","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:49.310","lastModified":"2026-07-27T05:16:35.687","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()\n\nnetfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it\nis wanting to unlock and compares that to rreq->no_unlock_folio so that it\ndoesn't unlock a folio being read for netfs_perform_write() or\nnetfs_write_begin().\n\nHowever, given that netfs_unlock_abandoned_read_pages() is called _after_\nNETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to\ndereference is the one specified by ->no_unlock_folio as ownership\nimmediately reverts to the caller.\n\nFix this by storing the folio pointer instead and using that rather than\nthe index.  Also fix netfs_unlock_read_folio() where the same applies."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/netfs/buffered_read.c","fs/netfs/read_collect.c","fs/netfs/read_retry.c","include/linux/netfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","lessThan":"6080fa3ecfbb4448a3b47368629534c09b6ec750","versionType":"git","status":"affected"},{"version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","lessThan":"3866d015f33aeedf81338dd99154703bef33faef","versionType":"git","status":"affected"},{"version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","lessThan":"dbe556972100fabb8e5a1b3d2163831ff07b1e8e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/netfs/buffered_read.c","fs/netfs/read_collect.c","fs/netfs/read_retry.c","include/linux/netfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3866d015f33aeedf81338dd99154703bef33faef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6080fa3ecfbb4448a3b47368629534c09b6ec750","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbe556972100fabb8e5a1b3d2163831ff07b1e8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64217","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:49.417","lastModified":"2026-07-27T05:16:35.803","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix overrun check in netfs_extract_user_iter()\n\nFix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills\npages[], then those pages don't get included in the iterator constructed at\nthe end of the function.  If there was an overfill, memory corruption has\nalready happened."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/netfs/iterator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"85dd2c8ff368b1446be9febde84afe1d7aec4261","lessThan":"00efe58bbdcc93272d579ca24bfc912563f4a204","versionType":"git","status":"affected"},{"version":"85dd2c8ff368b1446be9febde84afe1d7aec4261","lessThan":"96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9","versionType":"git","status":"affected"},{"version":"85dd2c8ff368b1446be9febde84afe1d7aec4261","lessThan":"afeb32d9bf9aaeea51d0f723a19f14afb73bd94d","versionType":"git","status":"affected"},{"version":"85dd2c8ff368b1446be9febde84afe1d7aec4261","lessThan":"f48b9157f0f611fa436c360648603d5ded719b12","versionType":"git","status":"affected"},{"version":"85dd2c8ff368b1446be9febde84afe1d7aec4261","lessThan":"0ef37eef83fad3542ee06db2940433ae1a92b39d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/netfs/iterator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/00efe58bbdcc93272d579ca24bfc912563f4a204","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0ef37eef83fad3542ee06db2940433ae1a92b39d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/afeb32d9bf9aaeea51d0f723a19f14afb73bd94d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f48b9157f0f611fa436c360648603d5ded719b12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64218","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:49.520","lastModified":"2026-07-27T05:16:35.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: fix report_work leak on backbone_gw purge\n\nbatadv_bla_purge_backbone_gw() removes stale backbone gateway entries,\nbut fails to properly handle their associated report_work:\n\n- If report_work is running, the purge must wait for it to finish before\n  freeing the backbone_gw, otherwise the worker may access freed memory\n  (e.g. bat_priv).\n- If report_work is pending, the purge must cancel it and release the\n  reference held for that pending work item.\n\nThe previous implementation called hlist_for_each_entry_safe() inside a\nspin_lock_bh() section, but cancel_work_sync() may sleep and therefore\ncannot be called from within a spinlock-protected region.\n\nRestructure the loop to handle one entry per spinlock critical section:\nacquire the lock, find the next entry to purge, remove it from the hash\nlist, then release the lock before calling cancel_work_sync() and\ndropping the hash_entry reference. Repeat until no more entries require\npurging."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/batman-adv/bridge_loop_avoidance.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"ce2c0ee4d76d5ee4b391fe0e31334361e25030ec","versionType":"git","status":"affected"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"3423a45e5c3d3c5129f88143a9a969787d7d5a0a","versionType":"git","status":"affected"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"f1303adb1e59582f76c22798a2e2e150e054a9e7","versionType":"git","status":"affected"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"48663158222b3b7f6ee6791a67d512ede7fc94bb","versionType":"git","status":"affected"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"eeddd7bab3d59c1e98642a204141f8c5d6194707","versionType":"git","status":"affected"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"c6de1a5a9c406e30b91f1515a6ce05cc84023baa","versionType":"git","status":"affected"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"95a7034661274cf5985708bd2f6d86ee46f88fa9","versionType":"git","status":"affected"},{"version":"23721387c409087fd3b97e274f34d3ddc0970b74","lessThan":"0459430add32ea41f3e2ef9351610e6d33627a6b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/batman-adv/bridge_loop_avoidance.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.5","status":"affected"},{"version":"0","lessThan":"3.5","versionType":"semver","status":"unaffected"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1303adb1e59582f76c22798a2e2e150e054a9e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64219","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:49.670","lastModified":"2026-07-27T05:16:36.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n\n[Why&How]\ndc_process_dmub_aux_transfer_async() copies payload->length bytes into a\n16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which\nis a no-op in release builds. If a caller ever passes length > 16 this\nresults in a stack buffer overflow via memcpy.\n\nAdditionally, link_index is used to dereference dc->links[] without\nbounds checking against dc->link_count, risking an out-of-bounds access.\n\nReplace the ASSERT with a hard runtime check that returns false when\npayload->length exceeds the destination buffer size, and add a bounds\ncheck for link_index before it is used.\n\n(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/display/dc/core/dc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6","lessThan":"d6590e3f766e3111dd1beaf88b9384d117acfa6b","versionType":"git","status":"affected"},{"version":"4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6","lessThan":"16a5fa57565afb6bf37e18129921c270c93d8e2b","versionType":"git","status":"affected"},{"version":"4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6","lessThan":"90c398e822ca76e40548df0c061dd4f93ea92d71","versionType":"git","status":"affected"},{"version":"4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6","lessThan":"3265f3ed373fb8048be713aadcdf702579a0e53d","versionType":"git","status":"affected"},{"version":"4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6","lessThan":"1ecde19bfce6535bffddad1139ff466b6d401b8e","versionType":"git","status":"affected"},{"version":"4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6","lessThan":"1c8c6e912f2945b2a3e669afca6b52174b88e86e","versionType":"git","status":"affected"},{"version":"4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6","lessThan":"6c92f6d9600efa3ef0d9e560a2b52776d9803c29","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/display/dc/core/dc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64221","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:49.923","lastModified":"2026-07-27T05:16:36.203","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ti-qspi: fix use-after-free after DMA setup failure\n\nThe driver falls back to PIO mode if DMA setup fails during probe.\n\nMake sure to clear the DMA channel pointer also if buffer allocation\nfails to avoid passing a pointer to the released channel to the DMA\nengine (or trying to free the channel a second time on late probe errors\nor driver unbind).\n\nThis issue was flagged by Sashiko when reviewing a devres allocation\nconversion patch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi-ti-qspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"9c6f306a8140962c7284197db54b96fdb5f468d6","versionType":"git","status":"affected"},{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6","versionType":"git","status":"affected"},{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"d6f422b122922d1abee907d673bcc990e5f3672d","versionType":"git","status":"affected"},{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"f2dc841d7dc9063fe9b47ced869b1271e55052ae","versionType":"git","status":"affected"},{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"1cd927002120678bd5d23c760246639caa53040e","versionType":"git","status":"affected"},{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"d7a076fb596c7b408ed6df74793a597990a6d860","versionType":"git","status":"affected"},{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"178b9b570c0f75fa7e691490520328b20d19138e","versionType":"git","status":"affected"},{"version":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83","lessThan":"ea6ec3343e05f7937a53eb6d7617b3abdb4abc19","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi-ti-qspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.142","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64222","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:50.053","lastModified":"2026-07-27T05:16:36.353","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: avoid double free of pool->stack on AQ init failure\n\notx2_pool_aq_init() frees pool->stack when mailbox sync or retry\nallocation fails, but leaves the pointer unchanged. Later,\notx2_sq_aura_pool_init() unwinds the partial setup through\notx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific\ncn20k_pool_aq_init() implementation has the same bug in\nits corresponding error path.\n\nSet pool->stack to NULL immediately after the local free so the shared\ncleanup path does not free the same stack again while cleaning up\npartially initialized pool state.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still present in\nv7.1-rc3.\n\nRuntime validation was not performed because reproducing this path\nrequires OcteonTX2/CN20K hardware."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c","drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"e6e9bc0bf963662b7042048ab0281014625d4cb4","versionType":"git","status":"affected"},{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"b92e7ea408b6f1144648909c9c49a55d245d7300","versionType":"git","status":"affected"},{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"94192b0579333c3deee2441379aab8ca98fc2e6b","versionType":"git","status":"affected"},{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"4c29603498b05c049dbbbc47e882f2fbf0193cd7","versionType":"git","status":"affected"},{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"0488a0bb344fb1992853b60082acff6be8164d74","versionType":"git","status":"affected"},{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"0d9b9d7dbef976ae7f855b6358f1d703014e96ea","versionType":"git","status":"affected"},{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec","versionType":"git","status":"affected"},{"version":"caa2da34fd25a37e9fd43343b6966fb9d730a6d5","lessThan":"9b244c242bec48b37e82b89787afd6a4c43457e1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c","drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0488a0bb344fb1992853b60082acff6be8164d74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0d9b9d7dbef976ae7f855b6358f1d703014e96ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c29603498b05c049dbbbc47e882f2fbf0193cd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94192b0579333c3deee2441379aab8ca98fc2e6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b244c242bec48b37e82b89787afd6a4c43457e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b92e7ea408b6f1144648909c9c49a55d245d7300","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6e9bc0bf963662b7042048ab0281014625d4cb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64223","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:50.197","lastModified":"2026-07-27T05:16:36.500","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: consume only present negotiated TTLM maps\n\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\nagainst the number of link-map entries indicated by link_map_presence.\nieee80211_parse_neg_ttlm() must consume the same layout.\n\nThe parser advanced its cursor for every TID, including TIDs whose\npresence bit is clear and therefore have no map bytes in the element.\nA sparse map can then make a later present TID read past the validated\nelement.\n\nThe bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by\nvalid_links before being applied to driver state, so a peer cannot\nturn the read into a policy change.  Under KUnit + KASAN with an\nexact-sized element allocation the OOB read is reported as a\nslab-out-of-bounds; whether the same trigger fires under the\nproduction RX path depends on surrounding allocator state.\n\nAdvance the cursor only when the current TID has a map present."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"f7d395dc5008168ac5b9c1ac2791e59a6078cca1","versionType":"git","status":"affected"},{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"2dd9304727c7041df0a599595910bdbe02ad03c5","versionType":"git","status":"affected"},{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f","versionType":"git","status":"affected"},{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64226","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:51.673","lastModified":"2026-07-27T05:16:36.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Avoid UAF in scx_root_enable_workfn() init failure path\n\nIn scx_root_enable_workfn(), put_task_struct(p) is called before scx_error()\ndereferences p->comm and p->pid. If the iterator's reference is the last\ndrop, the task is freed synchronously and the deref becomes a UAF.\n\nMove put_task_struct() past scx_error()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f0e1a0643a59bf1f922fa209cec86a170b784f3f","lessThan":"cf396941901858b0de426cdcd3974eea6a02c98c","versionType":"git","status":"affected"},{"version":"f0e1a0643a59bf1f922fa209cec86a170b784f3f","lessThan":"45c7c4e3db8b700307313c035ea08be829a7f21b","versionType":"git","status":"affected"},{"version":"f0e1a0643a59bf1f922fa209cec86a170b784f3f","lessThan":"57e19ba3f58a67eb924022a5a60b67fd08e5cbbd","versionType":"git","status":"affected"},{"version":"f0e1a0643a59bf1f922fa209cec86a170b784f3f","lessThan":"9a415cc53711f2238e0f0ca8a6bcc796c003b127","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/45c7c4e3db8b700307313c035ea08be829a7f21b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57e19ba3f58a67eb924022a5a60b67fd08e5cbbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a415cc53711f2238e0f0ca8a6bcc796c003b127","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf396941901858b0de426cdcd3974eea6a02c98c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64227","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:51.793","lastModified":"2026-07-27T05:16:36.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: driver: Check ACPI_COMPANION() against NULL during probe\n\nSince every platform driver can be forced to match a device that doesn't\nmatch its list of device IDs because of device_match_driver_override(),\nplatform drivers that rely on the existence of a device's ACPI companion\nobject should verify its presence.\n\nAccordingly, add requisite ACPI_COMPANION() or ACPI_HANDLE() checks\nagainst NULL to 13 platform drivers handling core ACPI devices.\n\nAlso change the value returned by the ACPI thermal zone driver when\nthe device's ACPI companion is not present to -ENODEV for consistency\nwith the other drivers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/ac.c","drivers/acpi/acpi_pad.c","drivers/acpi/acpi_tad.c","drivers/acpi/battery.c","drivers/acpi/button.c","drivers/acpi/ec.c","drivers/acpi/hed.c","drivers/acpi/nfit/core.c","drivers/acpi/pfr_telemetry.c","drivers/acpi/pfr_update.c","drivers/acpi/sbs.c","drivers/acpi/sbshc.c","drivers/acpi/thermal.c","drivers/acpi/tiny-power-button.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5829046825ac89fffc60f2670bc564fda2c0155a","lessThan":"a9451bf561232314755baf69a5916e0ac77f33fc","versionType":"git","status":"affected"},{"version":"5829046825ac89fffc60f2670bc564fda2c0155a","lessThan":"34f4d0e4e5065237d15651df759a99e81b7f9f51","versionType":"git","status":"affected"},{"version":"5829046825ac89fffc60f2670bc564fda2c0155a","lessThan":"612ddab8fce04394bd7aebe8e0f2599642e30859","versionType":"git","status":"affected"},{"version":"5829046825ac89fffc60f2670bc564fda2c0155a","lessThan":"e4865a56d013e86e46ea6acea15bb6eae01898ff","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/ac.c","drivers/acpi/acpi_pad.c","drivers/acpi/acpi_tad.c","drivers/acpi/battery.c","drivers/acpi/button.c","drivers/acpi/ec.c","drivers/acpi/hed.c","drivers/acpi/nfit/core.c","drivers/acpi/pfr_telemetry.c","drivers/acpi/pfr_update.c","drivers/acpi/sbs.c","drivers/acpi/sbshc.c","drivers/acpi/thermal.c","drivers/acpi/tiny-power-button.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/34f4d0e4e5065237d15651df759a99e81b7f9f51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/612ddab8fce04394bd7aebe8e0f2599642e30859","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9451bf561232314755baf69a5916e0ac77f33fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4865a56d013e86e46ea6acea15bb6eae01898ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64232","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:52.367","lastModified":"2026-07-27T05:16:36.857","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: recompute nr_integrity_segments in blk_insert_cloned_request\n\nblk_insert_cloned_request() already recomputes nr_phys_segments\nagainst the bottom queue, because \"the queue settings related to\nsegment counting may differ from the original queue.\" The exact same\nreasoning applies to integrity segments: a stacked driver's underlying\nqueue can have tighter virt_boundary_mask, seg_boundary_mask, or\nmax_segment_size than the top queue, in which case\nblk_rq_count_integrity_sg() against the bottom queue produces a\ndifferent count than the cached rq->nr_integrity_segments inherited\nfrom the source request by blk_rq_prep_clone().\n\nWhen the cached count is lower than the bottom queue's actual count,\nblk_rq_map_integrity_sg() trips\n\n\tBUG_ON(segments > rq->nr_integrity_segments);\n\non dispatch. The same families of stacked setups that motivated the\nexisting nr_phys_segments recompute -- dm-multipath fanning out to\nnvme-rdma in particular -- can produce this.\n\nMirror the nr_phys_segments handling: when the request carries\nintegrity, recompute nr_integrity_segments against the bottom queue\nand reject the request if it exceeds the bottom queue's\nmax_integrity_segments. blk_rq_count_integrity_sg() and\nqueue_max_integrity_segments() are both already available via\n<linux/blk-integrity.h>, which blk-mq.c includes.\n\nThis closes a latent gap in the stacking contract and brings the\nintegrity-segment accounting in line with the existing\nphys-segment accounting."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["block/blk-mq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76c313f658d2752e8527610677164aa7094ef7a5","lessThan":"53a01bcc0242590eda4c452a5bd996f62457113b","versionType":"git","status":"affected"},{"version":"76c313f658d2752e8527610677164aa7094ef7a5","lessThan":"0943f81e1b3176f27dbaf6db268fc69d8a94f0ba","versionType":"git","status":"affected"},{"version":"76c313f658d2752e8527610677164aa7094ef7a5","lessThan":"42929c98d044f126508baf54a65b0f87f932fa75","versionType":"git","status":"affected"},{"version":"76c313f658d2752e8527610677164aa7094ef7a5","lessThan":"2c6e6a18a37b905cb584eb0dda3ae482162a81ca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["block/blk-mq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0943f81e1b3176f27dbaf6db268fc69d8a94f0ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c6e6a18a37b905cb584eb0dda3ae482162a81ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42929c98d044f126508baf54a65b0f87f932fa75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53a01bcc0242590eda4c452a5bd996f62457113b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64235","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:52.737","lastModified":"2026-07-27T05:16:37.007","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines\n\nWith CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform\n(eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline\ncrashes on the first call into the traced function:\n\n  BUG: unable to handle page fault for address: ffff88817ae18880\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 4b53067 P4D 4b53067 PUD 0\n  Oops: Oops: 0002 [#1] SMP PTI\n  CPU: 3 UID: 0 PID: 187 Comm: usleep Not tainted 7.0.10 #243 PREEMPT(full)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\n  Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 <65> 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89\n  Call Trace:\n   <TASK>\n   ? find_held_lock\n   ? exc_page_fault\n   ? lock_release\n   ? __x64_sys_clock_nanosleep\n   ? lockdep_hardirqs_on_prepare\n   ? trace_hardirqs_on\n   __x64_sys_clock_nanosleep\n   do_syscall_64\n   ? exc_page_fault\n   ? call_depth_return_thunk\n   entry_SYSCALL_64_after_hwframe\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis small reproducer allows to easily trigger the crash:\n\n  # echo 'p __x64_sys_clock_nanosleep' > /sys/kernel/tracing/kprobe_events\n  # echo 1 > /sys/kernel/tracing/events/kprobes/p___x64_sys_clock_nanosleep_0/enable\n  # usleep 1\n\nMonitoring the crash under GDB points to the exact instruction in charge of\nincrementing the call depth:\n\n  sarq $5, %gs:__x86_call_depth(%rip)\n\nThis instruction matches the one inserted by the ftrace_regs_caller from\nftrace_64.S. This emitted code was likely working fine until the introduction\nof\n\n  59bec00ace28 (\"x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()\"):\n\nit has made the call depth accounting addressing relative to $rip, instead of\nbeing based on an absolute address.\n\nAs this code exact location depends on where the trampoline lives in memory,\nthe corresponding displacement needs to be adjusted at runtime to actually\ncorrectly find the per-cpu __x86_call_depth value, otherwise the targeted\naddress is wrong, leading to the page fault seen above.\n\nFix the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT\ninstruction (from ftrace_regs_caller) by calling text_poke_apply_relocation(),\nas it is done for example by the x86 BPF JIT compiler through\nx86_call_depth_emit_accounting(). This corrects both CALL_DEPTH_ACCOUNT slots,\nin ftrace_caller and ftrace_regs_caller.\n\n  [ bp: Massage. ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kernel/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"8093442a2d1d4b42b9340a86023ccb2afb30b93a","versionType":"git","status":"affected"},{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"d59cc66b702757e3c5a711e78a38583eac0c2738","versionType":"git","status":"affected"},{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"9edff632ca216169846f8a63a5a3dc467e239c7a","versionType":"git","status":"affected"},{"version":"59bec00ace28d565ae0a68b23063ef3b961d82d5","lessThan":"a17dc12bfed8868e6a86f3b45c16065a70641acb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kernel/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/8093442a2d1d4b42b9340a86023ccb2afb30b93a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9edff632ca216169846f8a63a5a3dc467e239c7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a17dc12bfed8868e6a86f3b45c16065a70641acb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d59cc66b702757e3c5a711e78a38583eac0c2738","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64237","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:52.960","lastModified":"2026-07-27T05:16:37.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: elan_i2c - validate firmware size before use\n\nEnsure that the firmware file is large enough to contain the expected\nnumber of pages and the signature (which resides at the end of the\nfirmware blob) before accessing them to prevent potential out-of-bounds\nreads."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/mouse/elan_i2c_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"47b52b98edfe34d0249e72f815215ef24311c3a3","versionType":"git","status":"affected"},{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"c2c3b33b3c0bf2c9427c0926817ef5ffac50de6f","versionType":"git","status":"affected"},{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"331d49b4e1c9efe4479bbd22922dfcdd8c64be7b","versionType":"git","status":"affected"},{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"48b0aa9c08a3ac8e0c0345b7ca581f552324e460","versionType":"git","status":"affected"},{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"3b37190ad3ded3a15fb1dbfc4f26df520a3e59bb","versionType":"git","status":"affected"},{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"bf769358419e00344c1b16fa034d058f563d46a1","versionType":"git","status":"affected"},{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"d97baee9590edf303b3eca432e61de9320834fe1","versionType":"git","status":"affected"},{"version":"bb03bf3f8427a38112819061fc8688999ba02f67","lessThan":"76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/mouse/elan_i2c_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.0","status":"affected"},{"version":"0","lessThan":"4.0","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/331d49b4e1c9efe4479bbd22922dfcdd8c64be7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b37190ad3ded3a15fb1dbfc4f26df520a3e59bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47b52b98edfe34d0249e72f815215ef24311c3a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48b0aa9c08a3ac8e0c0345b7ca581f552324e460","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf769358419e00344c1b16fa034d058f563d46a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2c3b33b3c0bf2c9427c0926817ef5ffac50de6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d97baee9590edf303b3eca432e61de9320834fe1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64243","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:53.680","lastModified":"2026-07-27T05:16:37.283","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: simple-mux: Fix enum control bounds check\n\nsimple_mux_control_put() rejects values greater than e->items, but\nenum control values are zero based. For the two-entry mux used by this\ndriver, valid values are 0 and 1, so value 2 must be rejected as well.\n\nAccepting e->items can store an invalid mux state, pass it to the GPIO\nsetter, and pass it on to the DAPM mux update path where it is used as\nan index into the enum text array.\n\nUse the same >= e->items check used by the ASoC enum helpers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/codecs/simple-mux.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"342fbb7578d1741ff646d7b08e14e8753267b9fa","lessThan":"6fb653b62f169f6050fac45b56bf21ad097e19f6","versionType":"git","status":"affected"},{"version":"342fbb7578d1741ff646d7b08e14e8753267b9fa","lessThan":"d8cc3e747b002a8b965c529de79c0654675b9a1a","versionType":"git","status":"affected"},{"version":"342fbb7578d1741ff646d7b08e14e8753267b9fa","lessThan":"5fe860af8630cf7c78523cbd68e5a234743585aa","versionType":"git","status":"affected"},{"version":"342fbb7578d1741ff646d7b08e14e8753267b9fa","lessThan":"2ff3ac6f7664fe5639cad01712ac5e021fa7939c","versionType":"git","status":"affected"},{"version":"342fbb7578d1741ff646d7b08e14e8753267b9fa","lessThan":"164dcbec9632ca93ae313e6da6e4e05584fa0f02","versionType":"git","status":"affected"},{"version":"342fbb7578d1741ff646d7b08e14e8753267b9fa","lessThan":"05ef77f02607a3dc5d7f9762cb990f76843315d4","versionType":"git","status":"affected"},{"version":"342fbb7578d1741ff646d7b08e14e8753267b9fa","lessThan":"f63ad68e18d774a5d15cd7e405ead63f6b322679","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/codecs/simple-mux.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/05ef77f02607a3dc5d7f9762cb990f76843315d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/164dcbec9632ca93ae313e6da6e4e05584fa0f02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ff3ac6f7664fe5639cad01712ac5e021fa7939c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fe860af8630cf7c78523cbd68e5a234743585aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fb653b62f169f6050fac45b56bf21ad097e19f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8cc3e747b002a8b965c529de79c0654675b9a1a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f63ad68e18d774a5d15cd7e405ead63f6b322679","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64245","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:53.917","lastModified":"2026-07-27T05:16:37.420","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: modedb: fix a possible UAF in fb_find_mode()\n\nIf mode_option is NULL, it is assigned from mode_option_buf:\n\n  if (!mode_option) {\n    fb_get_options(NULL, &mode_option_buf);\n    mode_option = mode_option_buf;\n  }\n\nLater, name is assigned from mode_option:\n\n  const char *name = mode_option;\n\nHowever, mode_option_buf is freed before name is no longer used:\n\n  kfree(mode_option_buf);\n\nwhile name is still accessed by:\n\n  if ((name_matches(db[i], name, namelen) ||\n\nSince name aliases mode_option_buf, this may result in a\nuse-after-free.\n\nFix this by extending the lifetime of mode_option_buf until the end of the\nfunction by using scope-based resource management for cleanup."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/video/fbdev/core/modedb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"089d924d03d5c17b05d02992f57671ccfba1c4f0","lessThan":"c7dc382439f7b019e207055b52e9cec051d42fa9","versionType":"git","status":"affected"},{"version":"089d924d03d5c17b05d02992f57671ccfba1c4f0","lessThan":"f906347d75c7fc377041c6d3c535d0f08846aada","versionType":"git","status":"affected"},{"version":"089d924d03d5c17b05d02992f57671ccfba1c4f0","lessThan":"4d418cf8daf57e454b4d855bf9b2419fd8e6a540","versionType":"git","status":"affected"},{"version":"089d924d03d5c17b05d02992f57671ccfba1c4f0","lessThan":"13b6f0cdd5cd5e60f682ec43134ab0e2024bd356","versionType":"git","status":"affected"},{"version":"089d924d03d5c17b05d02992f57671ccfba1c4f0","lessThan":"85b6256469cebdac395e7447147e06b2e151014f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/video/fbdev/core/modedb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/13b6f0cdd5cd5e60f682ec43134ab0e2024bd356","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d418cf8daf57e454b4d855bf9b2419fd8e6a540","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85b6256469cebdac395e7447147e06b2e151014f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7dc382439f7b019e207055b52e9cec051d42fa9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f906347d75c7fc377041c6d3c535d0f08846aada","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64247","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:54.147","lastModified":"2026-07-27T05:16:37.537","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: hyper-v: Bound the bank index when querying sparse banks\n\nWhen checking if a VP ID is included in a sparse bank set, explicitly check\nthat the ID can actually be contained in a sparse bank (the TLFS allows for\na maximum of 64 banks of 64 vCPUs each).  When handling a paravirtual TLB\nflush for L2, the VP ID is copied verbatim from the enlightened VMCS,\nwithout any bounds check, i.e. isn't guaranteed to be under the limit of\n4096.\n\nFailure to check the bounds of the VP ID leads to an out-of-bounds read\nwhen testing the sparse bank, and super strictly speaking could lead to KVM\nperforming an unnecessary TLB flush for an L2 vCPU.\n\n  ==================================================================\n  BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm]\n  Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802\n\n  CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x51/0x60\n   print_report+0xcb/0x5d0\n   kasan_report+0xb4/0xe0\n   kasan_check_range+0x35/0x1b0\n   hv_is_vp_in_sparse_set+0x85/0x100 [kvm]\n   kvm_hv_flush_tlb+0xe9e/0x16c0 [kvm]\n   kvm_hv_hypercall+0xe6b/0x1e60 [kvm]\n   vmx_handle_exit+0x485/0x1b60 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0x22e3/0x5070 [kvm]\n   kvm_vcpu_ioctl+0x5d0/0x10c0 [kvm]\n   __x64_sys_ioctl+0x129/0x1a0\n   do_syscall_64+0xb9/0xcf0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f0e62d1a9bf\n   </TASK>\n\n  The buggy address belongs to the physical page:\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f\n  flags: 0x4000000000000000(zone=1)\n  raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n  raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n   ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  >ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                              ^\n   ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n   ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  ==================================================================\n  Disabling lock debugging due to kernel taint\n\nOpportunistically add a compile time assertion to ensure the maximum number\nof sparse banks exactly matches the number of possible bits in the passed\nin mask.\n\n[sean: add KASAN splat, drop comment, add assert, massage changelog]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kvm/hyperv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c58a318f6090efe06e6702b8882e2026f44f620e","lessThan":"d18756b12aab30d07794446445c93112e5c69a2e","versionType":"git","status":"affected"},{"version":"c58a318f6090efe06e6702b8882e2026f44f620e","lessThan":"83c2f52c6a78b1590034e955cff3fe0b052fe4ae","versionType":"git","status":"affected"},{"version":"c58a318f6090efe06e6702b8882e2026f44f620e","lessThan":"e36095d8d922bb26ce860231aacf0cd14edea07c","versionType":"git","status":"affected"},{"version":"c58a318f6090efe06e6702b8882e2026f44f620e","lessThan":"f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130","versionType":"git","status":"affected"},{"version":"c58a318f6090efe06e6702b8882e2026f44f620e","lessThan":"4721f8160f17554b003e8928bb61e6c9b2fe92a3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kvm/hyperv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":5.8}]},"references":[{"url":"https://git.kernel.org/stable/c/4721f8160f17554b003e8928bb61e6c9b2fe92a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83c2f52c6a78b1590034e955cff3fe0b052fe4ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d18756b12aab30d07794446445c93112e5c69a2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e36095d8d922bb26ce860231aacf0cd14edea07c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64251","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:54.713","lastModified":"2026-07-27T05:16:37.683","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()\n\npwrseq_debugfs_seq_next() declares 'next' with __free(put_device),\nwhich causes put_device() to be called on the returned pointer when\nthe variable goes out of scope.  This results in a use-after-free\nsince the seq_file framework receives a pointer whose reference has\nalready been dropped.\n\nSimply removing __free(put_device) would fix the UAF but would leak\nthe reference acquired by bus_find_next_device(), as stop() only\ncalls up_read(&pwrseq_sem) and never releases the device reference.\n\nFix this by making the reference counting consistent across all\nseq_file callbacks, matching the standard pattern used by PCI and\nSCSI:\n\n- start(): use get_device() so it returns a referenced pointer.\n- next(): explicitly put_device(curr) to release the previous\n  device's reference (no NULL check needed - the seq_file framework\n  only calls next() while the previous return was non-NULL).\n- stop(): put_device(data) to release the last iterated device's\n  reference, with a NULL guard since stop() may be called with NULL\n  when start() returned NULL or next() reached end-of-sequence."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/power/sequencing/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c","lessThan":"ba0b9f04c7a5f9887b8ce672eaf049502c0548ec","versionType":"git","status":"affected"},{"version":"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c","lessThan":"e91df6d273445c03f5aa302bfe147eda33d45794","versionType":"git","status":"affected"},{"version":"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c","lessThan":"73569a44fca2992f0ca4a4c0104069741b9873a0","versionType":"git","status":"affected"},{"version":"249ebf3f65f8530beb2cbfb91bff1d83ba88d23c","lessThan":"257595adf9dac15ae1edd9d07753fbc576a7583d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/power/sequencing/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64255","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-24T16:16:55.257","lastModified":"2026-07-27T05:16:37.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers\n\nThree BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a\nstation ID without checking that sta_mask is non-zero. When sta_mask is\nzero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing\nan out-of-bounds access on fw_id_to_link_sta[].\n\nAdd WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call,\nconsistent with the existing check in iwl_mld_ampdu_rx_start()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/agg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9aa3856d9b6f3f8bf085b5bbb5f3703578bf452b","lessThan":"1de92789ce31e46fa7e7d8e89c90b19cdb1c103b","versionType":"git","status":"affected"},{"version":"9aa3856d9b6f3f8bf085b5bbb5f3703578bf452b","lessThan":"fe7f339f63c9dc4ca546ed7ac38ba4bb3a99dcfc","versionType":"git","status":"affected"},{"version":"9aa3856d9b6f3f8bf085b5bbb5f3703578bf452b","lessThan":"f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/agg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1de92789ce31e46fa7e7d8e89c90b19cdb1c103b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe7f339f63c9dc4ca546ed7ac38ba4bb3a99dcfc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64257","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:05.817","lastModified":"2026-07-27T05:16:37.930","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject overlapping data areas in SMB2 responses\n\nCommit 53b7c271f06b (\"smb: client: restrict implied bcc[0] exemption to\nresponses without data area\") restricted the implied bcc[0] length\nexception to responses without a data area. However, the overlap\nhandling in __smb2_calc_size() clears data_length, which can make an\ninvalid response appear to have no data area and so qualify for the\nexception.\n\nTrack data area overlap separately and reject such responses before\napplying the length compatibility exceptions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"31c6312608c60b72a1feb99a5afb680645a3e8a3","lessThan":"445ece263131780dee273d727a4d6f11934feec7","versionType":"git","status":"affected"},{"version":"573e502d14714d2947e22e7eff40ec20a6a44a42","lessThan":"36bfa52459e45c0d5b668de2f1c91f6dc5c67775","versionType":"git","status":"affected"},{"version":"419ec1b604d7fb60c10aec2dc062371f9fcd4940","lessThan":"4a9d2657d3e05f6ed09c148cb127b4e58702275f","versionType":"git","status":"affected"},{"version":"ceb875a375dedbf51c9425c1d13a2d7a8435c08c","lessThan":"fdafa1e68dc75045b7b617e6e7d2854950804d83","versionType":"git","status":"affected"},{"version":"6e9d10f62773b99bd927940fd9cbdfe7207e23ff","lessThan":"57cba95f0e97c6f6e45e6731da30aff091bd7460","versionType":"git","status":"affected"},{"version":"53b7c271f06be4dd5cfc8c6ef552a8355c891a7f","lessThan":"8986c932905ea508d66da421eb2eb6e676ace1fe","versionType":"git","status":"affected"},{"version":"8d0bbc78046d264bbf6a574ea6f9072258a43e35","versionType":"git","status":"affected"},{"version":"b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0","versionType":"git","status":"affected"},{"version":"5.10.261","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.212","lessThan":"5.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2-rc3","status":"affected"},{"version":"0","lessThan":"7.2-rc3","versionType":"semver","status":"unaffected"},{"version":"7.2-rc4","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/36bfa52459e45c0d5b668de2f1c91f6dc5c67775","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/445ece263131780dee273d727a4d6f11934feec7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a9d2657d3e05f6ed09c148cb127b4e58702275f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57cba95f0e97c6f6e45e6731da30aff091bd7460","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8986c932905ea508d66da421eb2eb6e676ace1fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdafa1e68dc75045b7b617e6e7d2854950804d83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64259","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:06.033","lastModified":"2026-07-27T05:16:38.057","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: make a fuse_req on SQE commit only findable after memcpy\n\nBad userspace might try to trick us and send commit SQEs request\nunique / commit-id of requests that are not even send to\nfuse-server (io_uring_cmd_done() not called) yet.\n\nfuse_uring_commit_fetch() ends the fuse request when the ring entry\nhas a wrong state, but that could have caused a use-after-free\nwith the memcpy operations in fuse_uring_send_in_task().\nIn order to avoid such races the call of fuse_uring_add_to_pq()\nis moved after the copy operations and just before completing\nthe io-uring request - malicious userspace cannot find the request\nanymore until all prepration work in fuse-client/kernel is completed.\n\nThis also moves fuse_uring_add_to_pq() a bit up in the code to\navoid a forward declaration. Also not with a preparation commit,\nto make it easier to back port to older kernels."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c090c8abae4b6b77a1bee116aa6c385456ebef96","lessThan":"e1711479e9068ea31b31353a702a51e639c3d059","versionType":"git","status":"affected"},{"version":"c090c8abae4b6b77a1bee116aa6c385456ebef96","lessThan":"a635f427d57e2012102ae4886b48d8955c59fb86","versionType":"git","status":"affected"},{"version":"c090c8abae4b6b77a1bee116aa6c385456ebef96","lessThan":"1efd3d474fc0ba74dfd984249bca78807d739812","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1efd3d474fc0ba74dfd984249bca78807d739812","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a635f427d57e2012102ae4886b48d8955c59fb86","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1711479e9068ea31b31353a702a51e639c3d059","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64260","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:06.137","lastModified":"2026-07-27T05:16:38.180","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: Avoid queue->stopped races and set/read that value under lock\n\nThere are several readers of queue->stopped that check the value\nunder lock, but fuse_uring_commit_fetch() did not and actually\nthe value was not set under the lock in fuse_uring_abort_end_requests()\neither. Especially in fuse_uring_commit_fetch it is important\nto check under a lock, because due to races 'struct fuse_req'\nmight be freed with fuse_request_end, but another thread/cpu\nmight already do teardown work."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4a9bfb9b6850fec0685447aed280533cf980de70","lessThan":"39c8e925b207afceffaa5382416ed405e0223a03","versionType":"git","status":"affected"},{"version":"4a9bfb9b6850fec0685447aed280533cf980de70","lessThan":"4021a3a79eee551d95fe1e1e7c1b195d34ba8c08","versionType":"git","status":"affected"},{"version":"4a9bfb9b6850fec0685447aed280533cf980de70","lessThan":"b70a3aca16934c196f92abb17b01c1647b9bb63c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/39c8e925b207afceffaa5382416ed405e0223a03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4021a3a79eee551d95fe1e1e7c1b195d34ba8c08","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b70a3aca16934c196f92abb17b01c1647b9bb63c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64261","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:06.243","lastModified":"2026-07-27T05:16:38.300","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues\n\nfuse_uring_async_stop_queues() might run when the last reference\non ring->queue_refs was already dropped.\n\nIn order to avoid an early destruction a reference on struct fuse_conn\nis now taken before starting fuse_uring_async_stop_queues() and that\nreference is only released when that delayed work queue terminates."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4a9bfb9b6850fec0685447aed280533cf980de70","lessThan":"23a356e0bd96c8d5fb3ddff069f692bf10cab5c1","versionType":"git","status":"affected"},{"version":"4a9bfb9b6850fec0685447aed280533cf980de70","lessThan":"95d7f50aff2a5f71557263ff25b97b2951f32bf8","versionType":"git","status":"affected"},{"version":"4a9bfb9b6850fec0685447aed280533cf980de70","lessThan":"d351da75066955144515cb2f9aa959f24a04287a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/23a356e0bd96c8d5fb3ddff069f692bf10cab5c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95d7f50aff2a5f71557263ff25b97b2951f32bf8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d351da75066955144515cb2f9aa959f24a04287a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64265","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:06.667","lastModified":"2026-07-27T05:16:38.417","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: clear intr_entry in fuse_resend and fuse_remove_pending_req\n\nWhen fuse_resend() moves a request from fpq->processing back to\nfiq->pending, it sets FR_PENDING and clears FR_SENT but does not\nremove the requests intr_entry from fiq->interrupts.  If the\nrequest had FR_INTERRUPTED set from a prior signal, intr_entry\nremains dangling on fiq->interrupts.  When the requesting task\nthen receives a fatal signal, fuse_remove_pending_req() sees\nFR_PENDING=1, removes the request from fiq->pending and frees it\nvia the refcount path, also without cleaning intr_entry.  The\nstale intr_entry causes use-after-free when fuse_read_interrupt()\niterates fiq->interrupts:\n  - list_del_init(&req->intr_entry) -> UAF write on freed slab\n  - req->in.h.unique -> UAF read, data leaked to userspace\n\nRemove intr_entry from fiq->interrupts in fuse_resend() for\ninterrupted requests before they are placed back on fiq->pending.\n\nAdd a WARN_ON if the intr_entry is not empty on request destruction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fuse/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"760eac73f9f69aa28fcb3050b4946c2dcc656d12","lessThan":"1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c","versionType":"git","status":"affected"},{"version":"760eac73f9f69aa28fcb3050b4946c2dcc656d12","lessThan":"7366e6f4d2b4c7002b13fb01219e83679dad4127","versionType":"git","status":"affected"},{"version":"760eac73f9f69aa28fcb3050b4946c2dcc656d12","lessThan":"893479015cb6442fd389d3b553ab3036c9541715","versionType":"git","status":"affected"},{"version":"760eac73f9f69aa28fcb3050b4946c2dcc656d12","lessThan":"f8fce75fedf73ac72aa09163deb8f4291fdcaad2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fuse/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7366e6f4d2b4c7002b13fb01219e83679dad4127","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/893479015cb6442fd389d3b553ab3036c9541715","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8fce75fedf73ac72aa09163deb8f4291fdcaad2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64266","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:06.783","lastModified":"2026-07-27T05:16:38.540","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before returning from fuse_ref_folio()\n\nfuse_ref_folio() unlocks the request but does not re-lock it before\nreturning. fuse_chan_abort() can end the request and the async end\ncallback (eg fuse_writepage_free()) can free the args while the\nsubsequent copy chain logic after fuse_ref_folio() accesses them,\nleading to use-after-free issues.\n\nFix this by locking the request in fuse_ref_folio() before returning."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fuse/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"1f9156714592356b4fda57beac7eab9c2a462dd3","versionType":"git","status":"affected"},{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"5630da218a45ba80f0aba0846cbe8aa655da122b","versionType":"git","status":"affected"},{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"1ca605cfa59377f0143fb35b5b01360f37d1b7c4","versionType":"git","status":"affected"},{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"0e4a5a000123d81234e27a2f8187688cf608f755","versionType":"git","status":"affected"},{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"e6aa539720c3d8def69683ed0c07cf9faea4e8be","versionType":"git","status":"affected"},{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"be353caffa8640f5e25fb3714ce8b0cef5e410e5","versionType":"git","status":"affected"},{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"65a1c2551f7e16085acbb54aedde1feaa559ba7a","versionType":"git","status":"affected"},{"version":"c3021629a0d820247ee12b6c5192a1d5380e21c6","lessThan":"b5befa80fdbe287a98480effed9564712924add5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fuse/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.35","status":"affected"},{"version":"0","lessThan":"2.6.35","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64268","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:07.013","lastModified":"2026-07-27T05:16:38.680","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge->laddr + wqe->processed and then\naccumulates wqe->processed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe->bytes only on the final segment (the !frx->more_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe->processed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/sw/siw/siw_qp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"a31b6d18ded3cc32d9ee85a6ff0726d4274887b2","versionType":"git","status":"affected"},{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"595e6537ad1a210da32cbb9a7f91aa73090915ba","versionType":"git","status":"affected"},{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf","versionType":"git","status":"affected"},{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"b2e26c955f8dd7e8d3f16c858db05245ea4fa817","versionType":"git","status":"affected"},{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"6bc89f34a4597f9f6d41f7a60c67a3153bfe8851","versionType":"git","status":"affected"},{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"423a78ff7928c2601013f73ec6d896f5597d0df5","versionType":"git","status":"affected"},{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"75c93cd3c421890f49ea93f0b978b9b7bb10e5e3","versionType":"git","status":"affected"},{"version":"8b6a361b8c482f22ac99c3273285ff16b23fba91","lessThan":"7d29f7e9dbd844cae4d3e559cf78324b9642fd6b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/sw/siw/siw_qp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64269","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:07.160","lastModified":"2026-07-27T05:16:38.830","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg\n\nWhen the server answers an RTRS READ, rdma_write_sg() builds the source\nscatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the\npeer. Its length is taken directly from the wire descriptor:\n\n  plist->length = le32_to_cpu(id->rd_msg->desc[0].len);\n\nrd_msg points into the chunk buffer that the remote peer filled via\nRDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -> process_io_req() ->\nprocess_read()), so desc[0].len is attacker-controlled and, before this\nchange, was only rejected when zero. The source address is the fixed\nchunk start (dma_addr[msg_id]) and the source lkey is the PD-wide\nlocal_dma_lkey, which is not tied to the chunk's MR mapping, so the verbs\nlayer does not constrain the transfer length to max_chunk_size. msg_id\nand off are bounded against queue_depth and max_chunk_size in\nrtrs_srv_rdma_done(), but desc[0].len is a separate field that was not\nchecked against the chunk size.\n\nA peer that advertises desc[0].len larger than max_chunk_size can make\nthe posted RDMA write read past the chunk's mapped region. The resulting\nbehaviour depends on the IOMMU configuration: with no IOMMU or in\npassthrough mode the read may extend into memory adjacent to the chunk\nand be returned to the peer, which can disclose host memory; with a\ntranslating IOMMU the out-of-range access is expected to fault and abort\nthe connection. In either case the transfer exceeds what the protocol\npermits and is driven by a remote peer.\n\nReject a descriptor length above max_chunk_size, mirroring the existing\noff >= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients\ndo not exceed it: the client sets desc[0].len to its MR length, which is\ncapped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-srv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"68c09762172f6224e9ddf9b0a60bacbb36e443eb","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"6cada540150894e81042a0ae0c796a21a9a877da","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"2912f3d40355dabc08fdbaaf2764d02445fe88dc","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"6f40246f4312fdbab5a13cc440adebf95eb2aa66","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"5a45d0aa1fa50a333ce5763ade744e2d89838667","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"da3e44add94b05dfde56f898421922f5cf35705f","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"963af8d97a8c6a117134a8d0db1415e0489200b1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-srv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/2912f3d40355dabc08fdbaaf2764d02445fe88dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a45d0aa1fa50a333ce5763ade744e2d89838667","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68c09762172f6224e9ddf9b0a60bacbb36e443eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cada540150894e81042a0ae0c796a21a9a877da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f40246f4312fdbab5a13cc440adebf95eb2aa66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/963af8d97a8c6a117134a8d0db1415e0489200b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da3e44add94b05dfde56f898421922f5cf35705f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64276","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:08.060","lastModified":"2026-07-27T05:16:38.973","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30->gpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput->keycodemax is set to the full gpioled_count while input->keycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count > 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/rmi4/rmi_f30.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"8c6d18d61bb6fe0e6edf848413391c590552e8a9","versionType":"git","status":"affected"},{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"d162a1ead7de404d8b41a093c83ed0db6487cded","versionType":"git","status":"affected"},{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"f0be9eba946e9200b43265e0a748d38bd0a56954","versionType":"git","status":"affected"},{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"26c895928d7118436a24f564587cb4aefc40cdd8","versionType":"git","status":"affected"},{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"4e3689c26854356f41fbaa1eafa382e58ac79e00","versionType":"git","status":"affected"},{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"e849c6f51e6877104c765da084e001ec37c8e119","versionType":"git","status":"affected"},{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"bfe622efecd4ff0a792d0ecd1a8dce535a902f50","versionType":"git","status":"affected"},{"version":"3e64fcbdbd10e46dede502d507dbcc104837cd59","lessThan":"d577e46785d45484b2ab7e7309c49b18764bf56c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/rmi4/rmi_f30.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64277","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:08.197","lastModified":"2026-07-27T05:16:39.117","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input->keycodemax is set to the full gpio_count\nwhile input->keycode points at the 6-entry allocation.\n\nA device that reports gpio_count > 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core's default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/rmi4/rmi_f3a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"502ad7caaa1a445b734c827fa256e5311df67e3d","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"3480e24bc4e178aaa009edb25b6ee12df199e210","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"35ed74d32d8260bdfb14a94caf402bf0866bdeec","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"ba57f430328534501962d60d651e385ffd7af9ca","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"850117b637bcb1dcc14be0cf09ac819a8707b42c","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"8db211aed83733073b0814adaeeab61d4521474e","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"57c10915f2c16c90e0d46ad00876bf39ece40fc2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/rmi4/rmi_f3a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64279","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:08.437","lastModified":"2026-07-27T05:16:39.260","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix adapter deregistration race\n\nAdapters can be looked up by their id using i2c_get_adapter() which\ntakes a reference to the embedded struct device.\n\nRemove the adapter from the IDR before tearing it down during\nderegistration (and on registration failure) to make sure its resources\nare not accessed after having been freed (e.g. the device name)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/i2c-core-base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"35fc37f8188177e3ba3e7f99a6e3300e490e9181","lessThan":"d39282f552dd6c35b9b84b4af78f1198c24f3373","versionType":"git","status":"affected"},{"version":"35fc37f8188177e3ba3e7f99a6e3300e490e9181","lessThan":"11dfa37bf544cc806f21742ca2fd2d841bd7032e","versionType":"git","status":"affected"},{"version":"35fc37f8188177e3ba3e7f99a6e3300e490e9181","lessThan":"9882a9bd74db08e7bae5821a7050627ae92d3380","versionType":"git","status":"affected"},{"version":"35fc37f8188177e3ba3e7f99a6e3300e490e9181","lessThan":"bb234487a447a99315add1b46aa57b72e163e1eb","versionType":"git","status":"affected"},{"version":"35fc37f8188177e3ba3e7f99a6e3300e490e9181","lessThan":"b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3","versionType":"git","status":"affected"},{"version":"35fc37f8188177e3ba3e7f99a6e3300e490e9181","lessThan":"35dbd1f1f603401155cbd3a180bb18e3a3b675b8","versionType":"git","status":"affected"},{"version":"35fc37f8188177e3ba3e7f99a6e3300e490e9181","lessThan":"b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/i2c-core-base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.31","status":"affected"},{"version":"0","lessThan":"2.6.31","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64280","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:08.553","lastModified":"2026-07-27T05:16:39.403","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()\n\nafu_ioctl_dma_map() accepts a 64-bit length from userspace via\nDFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value\nis passed to afu_dma_pin_pages() where npages is derived as\nlength >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes\nint nr_pages, causing implicit truncation if length is very large.\n\nValidate map.length at the ioctl entry point before calling\nafu_dma_map_region(), rejecting values whose page count exceeds\nINT_MAX."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/fpga/dfl-afu-main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fa8dda1edef9ebc3af467c644c5533ac97171e12","lessThan":"59070040fd12e0b78d7b4d341d9f9a183237c5ff","versionType":"git","status":"affected"},{"version":"fa8dda1edef9ebc3af467c644c5533ac97171e12","lessThan":"fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231","versionType":"git","status":"affected"},{"version":"fa8dda1edef9ebc3af467c644c5533ac97171e12","lessThan":"fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/fpga/dfl-afu-main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64281","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:08.667","lastModified":"2026-07-27T05:16:39.533","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: wake sq waiters when the transport closes\n\nThreads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or\nsc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state\nacross transport teardown, pinning svc_xprt references and\nblocking svc_rdma_free().\n\nThe close path sets XPT_CLOSE before invoking xpo_detach and both\nwait_event predicates include an XPT_CLOSE term, but the\npredicates are re-evaluated only on wakeup. sc_sq_ticket_wait has\nno completion-driven wake path; it is advanced solely by the\nchained ticket handoff inside svc_rdma_sq_wait() itself. Without\nan explicit wake at close, parked threads never observe\nXPT_CLOSE, hold their svc_xprt_get reference forever, and\nsvc_rdma_free() blocks on xpt_ref dropping to zero.\n\nTwo close entry points reach this transport. Local teardown runs\nsvc_rdma_detach() from svc_handle_xprt() -> svc_delete_xprt() ->\nxpo_detach() on a worker thread. A remote disconnect arrives at\nsvc_rdma_cma_handler(), which calls svc_xprt_deferred_close():\nthat sets XPT_CLOSE and enqueues the transport but does not\naccess either RDMA waitqueue, so a worker already parked in\nsvc_rdma_sq_wait() never re-evaluates its predicate. With every\nworker parked on this transport, no thread is available to run\nthe local teardown either, and the wake site there is\nunreachable.\n\nIntroduce svc_rdma_xprt_deferred_close(), a thin svcrdma wrapper\nthat calls svc_xprt_deferred_close() and then wakes both\nsc_sq_ticket_wait and sc_send_wait. Convert the svcrdma producers\nthat called svc_xprt_deferred_close() directly:\nsvc_rdma_cma_handler(), qp_event_handler(),\nsvc_rdma_post_send_err(), svc_rdma_wc_send(), the sendto drop\npath, the rw completion error paths, and the recvfrom flush and\nread-list error paths.\n\nWake both waitqueues from svc_rdma_detach() as well. The\nsynchronous svc_xprt_close() path (backchannel ENOTCONN, device\nremoval via svc_rdma_xprt_done) reaches detach without flowing\nthrough svc_xprt_deferred_close() and therefore does not invoke\nthe new helper.\n\n[ cel: add svc_rdma_xprt_deferred_close() to complete the fix ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/sunrpc/svc_rdma.h","net/sunrpc/xprtrdma/svc_rdma_recvfrom.c","net/sunrpc/xprtrdma/svc_rdma_rw.c","net/sunrpc/xprtrdma/svc_rdma_sendto.c","net/sunrpc/xprtrdma/svc_rdma_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ccc89b9d1ed233349cfe8d87b842e7351b74d8de","lessThan":"40eedc4253dbda0b29b7961200534dfcecb48ace","versionType":"git","status":"affected"},{"version":"ccc89b9d1ed233349cfe8d87b842e7351b74d8de","lessThan":"e5248a7426030db1e126363f72afdb3b71339a5c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/sunrpc/svc_rdma.h","net/sunrpc/xprtrdma/svc_rdma_recvfrom.c","net/sunrpc/xprtrdma/svc_rdma_rw.c","net/sunrpc/xprtrdma/svc_rdma_sendto.c","net/sunrpc/xprtrdma/svc_rdma_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/40eedc4253dbda0b29b7961200534dfcecb48ace","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5248a7426030db1e126363f72afdb3b71339a5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64284","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:09.033","lastModified":"2026-07-27T05:16:39.690","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits\n\nMove the handling of fastpath userspace exits into vendor code to ensure\nKVM runs vendor specific operations that need to run before userspace gains\ncontrol of the vCPU.  E.g. for VMX (and soon to be for SVM as well), KVM\nneeds to flush the PML buffer prior to exiting to userspace, otherwise any\nmemory written by the final KVM_RUN might never be flagged as dirty.\n\nNote, waiting to snapshot CR0 and CR3 until svm_handle_exit() is flawed in\ngeneral, as that risks consuming stale state in a fastpath handler.  That\nwill be addressed in a future change."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kvm/svm/svm.c","arch/x86/kvm/vmx/vmx.c","arch/x86/kvm/x86.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f7f39c50edb9d336274371953275e0d3503b9b75","lessThan":"b3436d9b9b1affe1c3191ac9831308923f5f03c3","versionType":"git","status":"affected"},{"version":"f7f39c50edb9d336274371953275e0d3503b9b75","lessThan":"4ad73ef0e7966ecfe67de0060537b4cb14d9acd4","versionType":"git","status":"affected"},{"version":"f7f39c50edb9d336274371953275e0d3503b9b75","lessThan":"f2ca2b5326211bd38490f0497eb583721ce0bbc0","versionType":"git","status":"affected"},{"version":"f7f39c50edb9d336274371953275e0d3503b9b75","lessThan":"0ffedf43910e44b76c2c1db4e9fbf12b268190c1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kvm/svm/svm.c","arch/x86/kvm/vmx/vmx.c","arch/x86/kvm/x86.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0ffedf43910e44b76c2c1db4e9fbf12b268190c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ad73ef0e7966ecfe67de0060537b4cb14d9acd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3436d9b9b1affe1c3191ac9831308923f5f03c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2ca2b5326211bd38490f0497eb583721ce0bbc0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64286","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:09.243","lastModified":"2026-07-27T05:16:39.863","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vCPU context into the hyp's private\nvCPU on every run. ctxt_to_vcpu() expects a guest context to have a\nNULL __hyp_running_vcpu, which is only ever set on the host context, so\nthat it resolves the vCPU via container_of(). While this is generally\nthe case, flush_hyp_vcpu() copies the context verbatim and does not\nenforce this, so a value provided by the host is dereferenced at EL2\n(host -> EL2).\n\nFix by clearing __hyp_running_vcpu after the copy."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kvm/hyp/nvhe/hyp-main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"477145860dba4c30f0b4e36f02f4c5291c1c888b","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"dfaef40d8a1533940fc1af788d70fce07362b4ce","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"d4f4d61715d1061ba83b88196a3605662be30750","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"e8042f6e1d7befb2fb6b10a75918642bcd0acf9a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kvm/hyp/nvhe/hyp-main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/477145860dba4c30f0b4e36f02f4c5291c1c888b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4f4d61715d1061ba83b88196a3605662be30750","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfaef40d8a1533940fc1af788d70fce07362b4ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8042f6e1d7befb2fb6b10a75918642bcd0acf9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64287","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:09.353","lastModified":"2026-07-27T05:16:39.990","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU\non every run. The vGIC list register save and restore use used_lrs as\ntheir loop bound and expect it to stay within the number of implemented\nlist registers. While this is generally the case, flush_hyp_vcpu()\ncopies vgic_v3 verbatim and does not enforce this, so a value provided\nby the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2\n(host -> EL2).\n\nFix by clamping used_lrs to the number of implemented list registers\nafter the copy, as the trusted path already does in\nvgic_flush_lr_state(). The number of implemented list registers is\nconstant after init, so it is replicated once from\nkvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on\nevery entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/include/asm/kvm_hyp.h","arch/arm64/kvm/arm.c","arch/arm64/kvm/hyp/nvhe/hyp-main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"9fa301d8298778dd799fa4dcf7a7f440715d146e","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"c646431865f4b1a5b14067233fa27b11e05e0d46","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"7fca3fcef81c713bc82a37bf741e0f28e6d04a6f","versionType":"git","status":"affected"},{"version":"be66e67f175096f283c9d5614c4991fc9e7ed975","lessThan":"8cc8bbbfab14c22c5551d0dd19b208a44b141c76","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/include/asm/kvm_hyp.h","arch/arm64/kvm/arm.c","arch/arm64/kvm/hyp/nvhe/hyp-main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64293","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:10.047","lastModified":"2026-07-27T05:16:40.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read\n\nThe bound-check in iommufd_veventq_fops_read() for the normal vEVENT\npath uses sizeof(hdr) where the surrounding code uses sizeof(*hdr):\n\n\tif (!vevent_for_lost_events_header(cur) &&\n\t    sizeof(hdr) + cur->data_len > count - done) {\n\nhdr is declared as struct iommufd_vevent_header *, so sizeof(hdr)\nevaluates to the size of the pointer.  Surrounding code uses\nsizeof(*hdr) consistently:\n\n\tif (done >= count || sizeof(*hdr) > count - done) {\n\t...\n\tif (copy_to_user(buf + done, hdr, sizeof(*hdr))) {\n\t...\n\tdone += sizeof(*hdr);\n\nstruct iommufd_vevent_header is currently 8 bytes (two __u32 fields,\nflags and sequence), so on 64-bit (sizeof(void *) == 8) the two\nexpressions happen to be equal and the check works as intended.\n\nOn 32-bit (sizeof(void *) == 4) the check under-counts the header by\n4 bytes: a vEVENT whose data_len causes 8 + cur->data_len to exceed\ncount - done while 4 + cur->data_len does not will pass the check,\nthen the loop will copy_to_user 8 bytes of header followed by data_len\nbytes of payload, writing past the user-supplied buffer.\n\nIt is also a latent bug for any future expansion of struct\niommufd_vevent_header beyond sizeof(void *) on 64-bit; the check\nshould not depend on the type happening to match the host pointer\nwidth.\n\nUse sizeof(*hdr) to match the rest of the function and the actual\namount that will be copied."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/iommufd/eventq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e36ba5ab808ef6237c3148d469c8238674230e2b","lessThan":"04a177f91160ee18da98f5689482cf0f589ec869","versionType":"git","status":"affected"},{"version":"e36ba5ab808ef6237c3148d469c8238674230e2b","lessThan":"0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72","versionType":"git","status":"affected"},{"version":"e36ba5ab808ef6237c3148d469c8238674230e2b","lessThan":"be93d186ae88a92e7aa77e122d4e661fa57b1e39","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/iommufd/eventq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/04a177f91160ee18da98f5689482cf0f589ec869","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be93d186ae88a92e7aa77e122d4e661fa57b1e39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64296","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:10.390","lastModified":"2026-07-27T05:16:40.240","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: bound uniname advance in exfat_find_dir_entry()\n\nIn exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the\noutput pointer by a fixed amount while the loop guard only tracks the\naccumulated name length:\n\n\tif (++order == 2)\n\t\tuniname = p_uniname->name;\n\telse\n\t\tuniname += EXFAT_FILE_NAME_LEN;\n\tlen = exfat_extract_uni_name(ep, entry_uniname);\n\tname_len += len;\n\tunichar = *(uniname+len);\n\t*(uniname+len) = 0x0;\n\nuniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len\ngrows only by the actual extracted length, which is shorter when a name\nfragment contains an early NUL.  The only guard is\n`name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short\nname fragments lets uniname run far past the\np_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small,\ncausing an out-of-bounds read and write at *(uniname+len).\n\nThe sibling extractor exfat_get_uniname_from_ext_entry() already stops\non a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard\nadded in commit d42334578eba (\"exfat: check if filename entries exceeds\nmax filename length\")); exfat_find_dir_entry() never got the\nequivalent.  Track the per-entry write offset as a count and reject a\nfragment once the offset, or the offset plus the extracted length, would\nexceed MAX_NAME_LENGTH, before forming the output pointer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/exfat/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"72a2589d82eb001c94b74bcfe6f9a599bd9bef60","versionType":"git","status":"affected"},{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4","versionType":"git","status":"affected"},{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"cf85180b8a015029ee147694eaf4e0b3537e9432","versionType":"git","status":"affected"},{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0","versionType":"git","status":"affected"},{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"727bf7783a2936ffd55c628dddfd69343e511dcf","versionType":"git","status":"affected"},{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"33c0b96d7e1672be1de0053786637ea46fb81507","versionType":"git","status":"affected"},{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"c8e041c68c0bbb73aa62371ee63947bb6949d8b2","versionType":"git","status":"affected"},{"version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","lessThan":"3a1230e7b043c62737b05a3e9275ca83a43ad20a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/exfat/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/33c0b96d7e1672be1de0053786637ea46fb81507","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a1230e7b043c62737b05a3e9275ca83a43ad20a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/727bf7783a2936ffd55c628dddfd69343e511dcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72a2589d82eb001c94b74bcfe6f9a599bd9bef60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8e041c68c0bbb73aa62371ee63947bb6949d8b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf85180b8a015029ee147694eaf4e0b3537e9432","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64298","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:10.657","lastModified":"2026-07-27T05:16:40.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfs/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"4817c8974315b666e895b7d1bb83cd3664c323b1","versionType":"git","status":"affected"},{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"cb148a2762d644bff1894728e8835a9a4b84f9ea","versionType":"git","status":"affected"},{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"30fdf4df6c3c00efec947e4ddf97f0fdd4473628","versionType":"git","status":"affected"},{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"22c1fd1355ad4ca27aa7f0fa02719122dd92d9de","versionType":"git","status":"affected"},{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230","versionType":"git","status":"affected"},{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"a937e92c1d00534b5c2e3e9f4381b7e988180797","versionType":"git","status":"affected"},{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"e36501b7d4abdcd6d69a7cb901b2f286b7a3d041","versionType":"git","status":"affected"},{"version":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be","lessThan":"5140f099ecd8a2f2808b7f7b720ee1bad8468974","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfs/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","lessThan":"2.6.24","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64299","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:10.793","lastModified":"2026-07-27T05:16:40.550","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent out-of-bounds read in glob matching\n\nString event fields are not necessarily NUL-terminated, so the filter\npredicate functions (filter_pred_string(), filter_pred_strloc() and\nfilter_pred_strrelloc()) pass the field length to the regex match\ncallbacks, and the length-aware matchers honour it.\n\nregex_match_glob() was the exception: it ignored the length and called\nglob_match(), which scans the string until it hits a NUL byte. Some\nstring fields are not NUL-terminated. One example is the dynamic char\narray of the xfs_* namespace tracepoints, which is copied without a\ntrailing NUL. For such a field, glob matching reads past the end of\nthe event field, causing a KASAN slab-out-of-bounds read in\nglob_match(), reached via regex_match_glob() and filter_match_preds()\nfrom the xfs_lookup tracepoint.\n\nAdd a length-bounded glob_match_len() and use it from regex_match_glob()\nso glob matching always stops at the field boundary. The matching loop\nis factored into a shared helper so glob_match() keeps its behaviour."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/glob.h","kernel/trace/trace_events_filter.c","lib/glob.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"265f3a690f6c7d69ef7d2ca50b04b4853a211df3","versionType":"git","status":"affected"},{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"ee5b8888d3248618251fb69a2fad92afcb81557e","versionType":"git","status":"affected"},{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"56d4c9ab84714eebb285a2fee68aaedf81e3ef15","versionType":"git","status":"affected"},{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"35ae19764eabfe9c29029d3b5713c86e6855acdf","versionType":"git","status":"affected"},{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"ebb55902856973906c8bb339a3a34824ed4a5086","versionType":"git","status":"affected"},{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"2dad64a97e1df47f5d9ccb17fa319aa348617226","versionType":"git","status":"affected"},{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"e5d5f3bd053a5f14787526c9f0f55ef900d43ac6","versionType":"git","status":"affected"},{"version":"60f1d5e3bac44b598f67d36062da96c095d2b700","lessThan":"0a6070839b1ef276d5b05bedfb787743e140fb17","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/glob.h","kernel/trace/trace_events_filter.c","lib/glob.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64300","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:10.930","lastModified":"2026-07-27T05:16:40.693","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/aux: Fix page UAF in map_range()\n\nmap_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via\nperf_mmap_to_page() while holding only event->mmap_mutex. Those fields are\nserialized by rb->aux_mutex, and mmap_mutex is per event.\n\nThus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race\nrb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows:\n\n  CPU 0                           CPU 1\n  =====                           =====\n  rb_alloc_aux()                  map_range()\n  [1]: allocate rb->aux_pages[0]\n  [2]: rb->aux_nr_pages++\n                                  [3]: perf_mmap_to_page()\n                                         returns rb->aux_pages[0]\n                                  [4]: map it as VM_PFNMAP\n  [5]: rb->aux_pgoff = 1\n\n  munmap the page\n  [6]: free rb->aux_pages[0]\n\nPages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a\nmapping to a freed physical frame.\n\nFix this by taking rb->aux_mutex across the page walk in map_range()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b709eb872e19a19607bbb6d2975bc264d59735cf","lessThan":"c8b7e113f7b61eef2f017e6329c27c2331058c5a","versionType":"git","status":"affected"},{"version":"b709eb872e19a19607bbb6d2975bc264d59735cf","lessThan":"0cff05bd2186020f8706233e261016d149cc24db","versionType":"git","status":"affected"},{"version":"b709eb872e19a19607bbb6d2975bc264d59735cf","lessThan":"5948aaf64f81f217a25dcc2bf6c0779bca19566c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5948aaf64f81f217a25dcc2bf6c0779bca19566c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8b7e113f7b61eef2f017e6329c27c2331058c5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64303","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:11.277","lastModified":"2026-07-27T05:16:40.813","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-lpspi: terminate the RX channel on TX prepare failure path\n\nWhen dmaengine_prep_slave_sg() fails for the TX channel, the error path\nterminates the TX DMA channel but leaves the RX channel running. Since\nthe RX channel was already submitted and issued prior to preparing\nthe TX descriptor, returning -EINVAL causes the SPI core to unmap the\nDMA buffers while the RX DMA engine continues writing to them, leading\nto potential memory corruption or use-after-free.\n\nTerminate the RX channel before returning on the TX prepare failure path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi-fsl-lpspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"ad370d1c7a9a832f77b2341513cd31188c9443af","versionType":"git","status":"affected"},{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"cce2063404b2341e7b2bbf85eddfcd70a31a0033","versionType":"git","status":"affected"},{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"af39a2698f69b584d14a00cffe0f51a2caa15337","versionType":"git","status":"affected"},{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"e65505d91fa036a238968e4c10744244d1b968c4","versionType":"git","status":"affected"},{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"d5c1060218a3749c8a18b36f8169d910fce20639","versionType":"git","status":"affected"},{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"808033d80d5c9f8adf7e8de9317389270ce13430","versionType":"git","status":"affected"},{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"9d000bdd250d649a11cd7f733175686877344582","versionType":"git","status":"affected"},{"version":"09c04466ce7ea494993c0635ba5edb6d2222a806","lessThan":"01980b5da56e573d62798d0ff6c86bcaa2b22cbe","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi-fsl-lpspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64304","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:11.403","lastModified":"2026-07-27T05:16:40.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - validate RSA CRT component lengths\n\nThe generic RSA key parser (rsa_helper.c) bounds each CRT component (p,\nq, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()\nallocates half-size DMA buffers (key_sz / 2) and right-aligns each\ncomponent with:\n\n    memcpy(dst + half_key_sz - len, src, len)\n\nWhen a CRT component is larger than half_key_sz the subtraction\nunderflows and memcpy writes past the DMA buffer, causing memory\ncorruption.\n\nAdd a len > half_key_sz check next to the existing !len check for each\nof the five CRT components so the driver falls back to the non-CRT path\ninstead of writing out of bounds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/crypto/intel/qat/qat_common/qat_asym_algs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"6d99c5fadd2df488103f64d6475b63ba6852202b","versionType":"git","status":"affected"},{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"c34369473bfe92a0b46ec78d6358e30341c7f481","versionType":"git","status":"affected"},{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"1002719d13072a5e4be1e993aa61dffb4a604e82","versionType":"git","status":"affected"},{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"500319830d76911c120dc0b9605f8c16d7702844","versionType":"git","status":"affected"},{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"3d61a214fdcda41f1ebfabbb483404032a7b4d91","versionType":"git","status":"affected"},{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a","versionType":"git","status":"affected"},{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"ce42224487c504aee4b7ff3a7342e7b4d7e28cc9","versionType":"git","status":"affected"},{"version":"879f77e9071f029e1c9bd5a75814ecf51370f846","lessThan":"b3ac78756588059729b9195fcc9f4b37d54057a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/crypto/intel/qat/qat_common/qat_asym_algs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64311","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:12.263","lastModified":"2026-07-27T05:16:41.087","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: loongson - Remove broken and unused loongson-rng\n\nThe loongson-rng rng_alg has several vulnerabilities, including not\nproviding forward security, and a use-after-free bug due to the use of\nwait_for_completion_interruptible().\n\nMeanwhile, the rng_alg framework doesn't really have any purpose in the\nfirst place other than to access the software algorithms crypto/drbg.c\nand crypto/jitterentropy.c.  Hardware-specific rng_algs have no\nin-kernel user, and unlike hwrng there's no feed into the actual Linux\nRNG.  As such, there's really no point to this code.  There are of\ncourse other rng_alg drivers that are similarly unused, but they're\nsimilarly in the process of being phased out, e.g.\nhttps://lore.kernel.org/r/20260529193648.18172-1-ebiggers@kernel.org and\nhttps://lore.kernel.org/r/20260529220430.34135-1-ebiggers@kernel.org\n\nGiven that, there's no point in fixing forward these vulnerabilities,\nand it makes much more sense to simply roll back the addition of this\ndriver.  If this platform provides TRNG (not PRNG) functionality, it\ncould make sense to add a hwrng driver, but it would be quite different."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["MAINTAINERS","arch/loongarch/configs/loongson32_defconfig","arch/loongarch/configs/loongson64_defconfig","drivers/crypto/Kconfig","drivers/crypto/Makefile","drivers/crypto/loongson/Kconfig","drivers/crypto/loongson/Makefile","drivers/crypto/loongson/loongson-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"766b2d724c8df071031412eea902b566a0049c31","lessThan":"037ec8353711c79353b12d5634e0c9ff363a9efa","versionType":"git","status":"affected"},{"version":"766b2d724c8df071031412eea902b566a0049c31","lessThan":"43de8b9f01b7dd2f6ca5360c6bf2f203c02288dc","versionType":"git","status":"affected"},{"version":"766b2d724c8df071031412eea902b566a0049c31","lessThan":"af3d1bb9a09daf928fc3f173689fb7904d6a6d4f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["MAINTAINERS","arch/loongarch/configs/loongson32_defconfig","arch/loongarch/configs/loongson64_defconfig","drivers/crypto/Kconfig","drivers/crypto/Makefile","drivers/crypto/loongson/Kconfig","drivers/crypto/loongson/Makefile","drivers/crypto/loongson/loongson-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/037ec8353711c79353b12d5634e0c9ff363a9efa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/43de8b9f01b7dd2f6ca5360c6bf2f203c02288dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af3d1bb9a09daf928fc3f173689fb7904d6a6d4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64312","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:12.373","lastModified":"2026-07-27T05:16:41.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata.  If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback.  Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly.  This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["crypto/pcrypt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a92ccd3618e42333ac6f150ecdac14dca298bc7a","lessThan":"81ce16d938db9b88cdc231522c0358395ae8c6b5","versionType":"git","status":"affected"},{"version":"96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca","lessThan":"3920c5f6edc341729d20d0507e466c6d3b11f372","versionType":"git","status":"affected"},{"version":"92834692a539b5b7f409e467a14667d64713b732","lessThan":"ae93c5b3e2a2968b56d772ca1d06615927b7cc36","versionType":"git","status":"affected"},{"version":"5edae7a9a35606017ee6e05911c290acee9fee5a","lessThan":"82789a44415e3e31168229421b138278dfb16412","versionType":"git","status":"affected"},{"version":"7ddab756f2de5b7b43c122ebebdf37f400fb2b6f","lessThan":"4711ca06bd169a2cbc9cc59a6de2ed512c41a880","versionType":"git","status":"affected"},{"version":"662f2f13e66d3883b9238b0b96b17886179e60e2","lessThan":"c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf","versionType":"git","status":"affected"},{"version":"662f2f13e66d3883b9238b0b96b17886179e60e2","lessThan":"83fa1397d5853de1e27dd52ec44b068ff358ca18","versionType":"git","status":"affected"},{"version":"662f2f13e66d3883b9238b0b96b17886179e60e2","lessThan":"ed459fe319376e876de433d12b6c6772e612ca36","versionType":"git","status":"affected"},{"version":"dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6","versionType":"git","status":"affected"},{"version":"fca8aed12218f96b38e374ff264d78ea1fbd23cc","versionType":"git","status":"affected"},{"version":"a8e0074ffb38c9a5964a221bb998034d016c93a2","versionType":"git","status":"affected"},{"version":"5.10.231","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.15.174","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.120","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.64","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.2","lessThan":"6.12.96","versionType":"semver","status":"affected"},{"version":"4.19.325","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.287","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"6.11.11","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["crypto/pcrypt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64313","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:12.517","lastModified":"2026-07-27T05:16:41.360","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ecc - Fix carry overflow in vli multiplication\n\nThe carry flag calculation fails when r01.m_high is saturated\n(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.\n\nThe condition (r01.m_high < product.m_high) doesn't handle the case\nwhere r01.m_high == product.m_high and an additional carry exists\nfrom lower-bit overflow.\n\nWhen commit 3c4b23901a0c (\"crypto: ecdh - Add ECDH software support\")\nintroduced crypto/ecc.c, it split the muladd() function in the\nmicro-ecc library into separate mul_64_64() and add_128_128() helpers.\nIt seems the check got lost in translation.\n\nAdd proper handling for this boundary by accounting for the carry\nfrom the lower addition."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["crypto/ecc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"d11b2bb99bec1f5557c01cac42231e23745f49b8","versionType":"git","status":"affected"},{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"b709e0e768766abe29a49e1c1922a1604be602f4","versionType":"git","status":"affected"},{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"24a54dfa06d09813b4802a374fad3d2c0e16a884","versionType":"git","status":"affected"},{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"677450e5ef850c4d28b7956aa01104548c2a894e","versionType":"git","status":"affected"},{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"5275e0fca256d081e2e7d4ba3dd8216c6e50d44e","versionType":"git","status":"affected"},{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"774ddddf5eb26eeca177350413e3e2bc50930ee9","versionType":"git","status":"affected"},{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"ebaae7c4251cc0cdb2602f334d4f08a3e82d271e","versionType":"git","status":"affected"},{"version":"3c4b23901a0c766879dff680cd6bdab47bcdbbd2","lessThan":"27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["crypto/ecc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/24a54dfa06d09813b4802a374fad3d2c0e16a884","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5275e0fca256d081e2e7d4ba3dd8216c6e50d44e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/677450e5ef850c4d28b7956aa01104548c2a894e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/774ddddf5eb26eeca177350413e3e2bc50930ee9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b709e0e768766abe29a49e1c1922a1604be602f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d11b2bb99bec1f5557c01cac42231e23745f49b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebaae7c4251cc0cdb2602f334d4f08a3e82d271e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64315","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:12.750","lastModified":"2026-07-27T05:16:41.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - use print_hex_dump_devel to guard key hex dumps\n\nUse print_hex_dump_devel() for dumping sensitive key material in\n*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG\nis enabled."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/crypto/caam/caamalg_qi2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"1ec775f6a124cce6278ae58b7d1c78a3bc6eef23","versionType":"git","status":"affected"},{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"bcf3cf74dfb6981e18b22cbf561f859a0f7faa26","versionType":"git","status":"affected"},{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"6407dc85d0a4306681cf6c9be7f05e05dcb67a37","versionType":"git","status":"affected"},{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"c8cfe11e48b2a4646fa662fcaa92e14810a28d46","versionType":"git","status":"affected"},{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7","versionType":"git","status":"affected"},{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"d0b8cafd529b4ec759190c6081f7a76efb563a8f","versionType":"git","status":"affected"},{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"59057f5d4e9a195c6dd61695ad3bc4481ddf4f14","versionType":"git","status":"affected"},{"version":"8d818c1055013d355d36188f21c7535687374f6c","lessThan":"8005dc808bcce7d6cc2ae015a3cde1683bee602d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/crypto/caam/caamalg_qi2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1ec775f6a124cce6278ae58b7d1c78a3bc6eef23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59057f5d4e9a195c6dd61695ad3bc4481ddf4f14","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6407dc85d0a4306681cf6c9be7f05e05dcb67a37","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8005dc808bcce7d6cc2ae015a3cde1683bee602d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bcf3cf74dfb6981e18b22cbf561f859a0f7faa26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8cfe11e48b2a4646fa662fcaa92e14810a28d46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0b8cafd529b4ec759190c6081f7a76efb563a8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64317","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:13.010","lastModified":"2026-07-27T05:16:41.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: bound Rock Ridge symlink components to the SL record\n\nget_symlink_chunk() and the SL handling in\nparse_rock_ridge_inode_internal() walk the variable-length components of\na Rock Ridge \"SL\" (symbolic link) record.  Each component is a two-byte\nheader (flags, len) followed by len bytes of text, so it occupies\nslp->len + 2 bytes.  Both loops read slp->len and advance to the next\ncomponent, and get_symlink_chunk() additionally does\nmemcpy(rpnt, slp->text, slp->len), but neither checks that the component\nlies within the SL record before dereferencing it.\n\nA crafted SL record whose component declares a len that runs past the\nrecord (rr->len) therefore triggers an out-of-bounds read of up to 255\nbytes.  When the record sits at the tail of its backing buffer - for\nexample a small kmalloc()ed continuation block reached through a CE\nrecord - the read crosses the allocation; get_symlink_chunk() then\ncopies the out-of-bounds bytes into the symlink body returned to user\nspace by readlink(), disclosing adjacent kernel memory.\n\nISO 9660 images are routinely mounted from untrusted removable media -\ndesktop environments auto-mount them (e.g. via udisks2) without\nCAP_SYS_ADMIN - so the record contents are attacker-controlled.\n\nReject any component that does not fit in the remaining record bytes\nbefore using it.  In get_symlink_chunk() return NULL, like the existing\noutput-buffer (plimit) checks, so a malformed record makes readlink()\nfail with -EIO rather than silently returning a truncated target; in\nparse_rock_ridge_inode_internal() stop the inode-size walk."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/isofs/rock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1015e1c4b2fadd9c09704e24738e46598778c869","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a22cb6bb54dc167047ea9e70d97dfbc2c15649e3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b736b12108fd116c41777628f5a333791604df26","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6bf41db09ef935d76fcc84ccf213b42c18de95ee","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b5699642640d6cff357638738c5293985cd5a53d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9830725078c8483c6831ec10222ae724806ea36b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5fa1d6a5ec2356d2107dead614437c66fa7138b1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/isofs/rock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/1015e1c4b2fadd9c09704e24738e46598778c869","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fa1d6a5ec2356d2107dead614437c66fa7138b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bf41db09ef935d76fcc84ccf213b42c18de95ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9830725078c8483c6831ec10222ae724806ea36b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a22cb6bb54dc167047ea9e70d97dfbc2c15649e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5699642640d6cff357638738c5293985cd5a53d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b736b12108fd116c41777628f5a333791604df26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64318","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:13.147","lastModified":"2026-07-27T05:16:41.787","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npartitions: aix: bound the pp_count scan to the ppe array\n\naix_partition() reads the physical volume descriptor into a fixed-size\nstruct pvd and then scans its physical-partition-extent array:\n\n\tint numpps = be16_to_cpu(pvd->pp_count);\n\t...\n\tfor (i = 0; i < numpps; i += 1) {\n\t\tstruct ppe *p = pvd->ppe + i;\n\t\t...\n\t\tlp_ix = be16_to_cpu(p->lp_ix);\n\npvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a\nfixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the\non-disk pp_count.  pp_count is an unvalidated __be16 read straight from\nthe descriptor, so a crafted AIX image with pp_count larger than 1016\ndrives the loop to read pvd->ppe[i] past the end of the allocation (up\nto 65535 entries, ~2 MB out of bounds).\n\nThe partition scan runs without mounting anything, when a block device\nwith a crafted AIX/IBM partition table appears (an attacker-supplied\nimage attached with losetup -P, or a device auto-scanned by udev), via\nmsdos_partition() -> aix_partition().\n\nClamp the scan to the number of entries the ppe[] array can hold."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["block/partitions/aix.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"09861651617ba0fec089e8b9477439e68398c110","versionType":"git","status":"affected"},{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"5eacdb1967378f5e5591cd27a2d8cdee2df1a599","versionType":"git","status":"affected"},{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"b5e9c09309e18fd9839ad007c238120353ca0cc4","versionType":"git","status":"affected"},{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"fd94a779020f2ecc8b2607f4c20b34acb1763b9a","versionType":"git","status":"affected"},{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"4671bb74bba05fdd4acf670a35758c29e8c97b83","versionType":"git","status":"affected"},{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"ce93228e2193a17d2c58b656e439bb39fe5c3af8","versionType":"git","status":"affected"},{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e","versionType":"git","status":"affected"},{"version":"6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6","lessThan":"2dc0bfd2fe355fb930de63c2f2eb8ced8570c579","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["block/partitions/aix.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.11","status":"affected"},{"version":"0","lessThan":"3.11","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/09861651617ba0fec089e8b9477439e68398c110","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2dc0bfd2fe355fb930de63c2f2eb8ced8570c579","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4671bb74bba05fdd4acf670a35758c29e8c97b83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5eacdb1967378f5e5591cd27a2d8cdee2df1a599","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5e9c09309e18fd9839ad007c238120353ca0cc4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce93228e2193a17d2c58b656e439bb39fe5c3af8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd94a779020f2ecc8b2607f4c20b34acb1763b9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64319","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:13.290","lastModified":"2026-07-27T05:16:41.930","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: validate reply message payload bounds against transfer length\n\nnvmet_auth_reply() accesses the variable-length rval[] array using\nattacker-controlled hl (hash length) and dhvlen (DH value length) fields\nwithout verifying they fit within the allocated buffer of tl bytes.\n\nA malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a\nsmall transfer length but large hl/dhvlen values, causing out-of-bounds\nheap reads when the target processes the DH public key (rval + 2*hl) or\nperforms the host response memcmp.\n\nWith DH authentication configured, the OOB pointer is passed directly to\nsg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching\nup to 526 bytes past the buffer. This is exploitable pre-authentication.\n\nAdd bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before\nany access to the variable-length fields.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0","versionType":"git","status":"affected"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"999f6205ede984a786f35f727b01f971b98e215d","versionType":"git","status":"affected"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"6d7649c1231dac14d906985d2936967e23041c26","versionType":"git","status":"affected"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"caa71b3a43ea5c13fe7141cb019ebcb03b8ac857","versionType":"git","status":"affected"},{"version":"db1312dd95488b5e6ff362ff66fcf953a46b1821","lessThan":"3a413ece2504c70aa34a20be4dafec04e8c741f9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/target/fabrics-cmd-auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64320","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:13.407","lastModified":"2026-07-27T05:16:42.073","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page\n\nnvmet_execute_disc_get_log_page() validates only the dword alignment\nof the host-supplied Log Page Offset (lpo).  The 64-bit offset is then\nadded to a small kzalloc'd buffer that holds the discovery log page\nand the result is passed straight to nvmet_copy_to_sgl(), which\nmemcpy()s data_len bytes out to the host with no source-side bound\ncheck:\n\n    u64 offset      = nvmet_get_log_page_offset(req->cmd);  /* 64-bit host */\n    size_t data_len = nvmet_get_log_page_len(req->cmd);     /* 32-bit host */\n    ...\n    if (offset & 0x3) { ... }                               /* only check */\n    ...\n    alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);\n    buffer = kzalloc(alloc_len, GFP_KERNEL);\n    ...\n    status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);\n\nThe Discovery controller is unauthenticated -- nvmet_host_allowed()\nreturns true unconditionally for the discovery subsystem -- so the call\nis reachable pre-authentication by any TCP/RDMA/FC peer that can reach\nthe nvmet target.  With a discovery log page of ~1 KiB, an attacker\nrequesting up to 4 KiB starting at offset == alloc_len reads the next\nslab page out and gets its content returned over the fabric (an\nempirical run on a default nvmet-tcp loopback target leaked 81\ncanonical kernel pointers in one Get Log Page response).  Pointing the\noffset at unmapped kernel memory faults the in-kernel memcpy and\ncrashes (or panics, on panic_on_oops=1) the target host instead.\n\nThe attacker-controlled source-side offset pattern\n\"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)\" is unique\nto nvmet_execute_disc_get_log_page in the entire nvmet codebase: every\nother Get Log Page handler in admin-cmd.c either ignores lpo (and\nsilently starts every response at offset 0) or tracks a local\ndestination offset with a fixed source pointer.\n\nValidate the host-supplied offset against the log page size, cap the\ncopy length to what is actually available, and zero-fill any remainder\nof the host transfer buffer.  The zero-fill matches the existing\nshort-response pattern in nvmet_execute_get_log_changed_ns()\n(admin-cmd.c) and prevents leaking transport SGL contents when the\nhost asks for more bytes than the log page contains."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/target/discovery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a07b4970f464f13640e28e16dad6cfa33647cc99","lessThan":"33b974eb626154ae9348f2bac7de84cb2a3d9dd4","versionType":"git","status":"affected"},{"version":"a07b4970f464f13640e28e16dad6cfa33647cc99","lessThan":"56c021a0869260d04c4b65d1471936aaf9177114","versionType":"git","status":"affected"},{"version":"a07b4970f464f13640e28e16dad6cfa33647cc99","lessThan":"a29b316b9bbfd269f323ab4ba9906a894025680f","versionType":"git","status":"affected"},{"version":"a07b4970f464f13640e28e16dad6cfa33647cc99","lessThan":"53cd102a7a56079b11b897835bd9b94c14e6322c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/target/discovery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/33b974eb626154ae9348f2bac7de84cb2a3d9dd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53cd102a7a56079b11b897835bd9b94c14e6322c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56c021a0869260d04c4b65d1471936aaf9177114","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a29b316b9bbfd269f323ab4ba9906a894025680f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64322","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:13.640","lastModified":"2026-07-27T05:16:42.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate sparing table length as an entry count, not a byte count\n\nudf_load_sparable_map() accepts a sparing table when\n\n\tsizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize\n\nis false, i.e. it treats reallocationTableLen as a number of BYTES that\nmust fit in the block.  But the table is walked as an array of 8-byte\nsparingEntry elements:\n\n\tfor (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) {\n\t\tstruct sparingEntry *entry = &st->mapEntry[i];\n\t\t... entry->origLocation ...\n\t}\n\nin udf_get_pblock_spar15() and udf_relocate_blocks().  A\nreallocationTableLen of N therefore passes the check whenever\nsizeof(*st) + N <= blocksize, yet the consumers index\nsizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the\nblock.  On a crafted UDF image this is an out-of-bounds read in\nudf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the\nsame length to udf_update_tag(), whose crc_itu_t() reads far past the\nblock, and its memmove() through st->mapEntry[] is an out-of-bounds\nwrite.\n\nValidate reallocationTableLen as the entry count it is, with\nstruct_size()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/udf/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e","versionType":"git","status":"affected"},{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9","versionType":"git","status":"affected"},{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"2d726135099313958f8975532a2e15322ff150ce","versionType":"git","status":"affected"},{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"7285276aa50d2839afb5957ffd491ad282dc8f72","versionType":"git","status":"affected"},{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"2a219acb2ce674d99bbd1b7b35ed8c384dac7200","versionType":"git","status":"affected"},{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"04f4599a9efb90992d072a814960edf0cd62805d","versionType":"git","status":"affected"},{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"7f7774b9da0ef17b87bfa238cf966ad0b3376150","versionType":"git","status":"affected"},{"version":"1df2ae31c724e57be9d7ac00d78db8a5dabdd050","lessThan":"3ec997bd5508e9b25210b5bbec89031629cdb093","versionType":"git","status":"affected"},{"version":"e240873cb4a9fd18de60a817100a96fe670d4359","versionType":"git","status":"affected"},{"version":"9ae30e324a96d0328a575329d7a95a09b3318601","versionType":"git","status":"affected"},{"version":"b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa","versionType":"git","status":"affected"},{"version":"a9f1af04f086656246f30354fb4564ce3b08c4a0","versionType":"git","status":"affected"},{"version":"4836ee563d65bb492f907cbe267a5761b9693e4d","versionType":"git","status":"affected"},{"version":"2.6.32.60","lessThan":"2.6.33","versionType":"semver","status":"affected"},{"version":"2.6.34.14","lessThan":"2.6.35","versionType":"semver","status":"affected"},{"version":"3.0.37","lessThan":"3.1","versionType":"semver","status":"affected"},{"version":"3.2.23","lessThan":"3.3","versionType":"semver","status":"affected"},{"version":"3.4.5","lessThan":"3.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/udf/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.5","status":"affected"},{"version":"0","lessThan":"3.5","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64323","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:13.790","lastModified":"2026-07-27T05:16:42.370","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate VAT header length against the VAT inode size\n\nudf_load_vat() takes the virtual partition's start offset straight from\nthe on-disk VAT 2.0 header without checking it against the VAT inode\nsize:\n\n\tmap->s_type_specific.s_virtual.s_start_offset =\n\t\tle16_to_cpu(vat20->lengthHeader);\n\tmap->s_type_specific.s_virtual.s_num_entries =\n\t\t(sbi->s_vat_inode->i_size -\n\t\t\tmap->s_type_specific.s_virtual.s_start_offset) >> 2;\n\nlengthHeader is a fully attacker-controlled 16-bit value.  If it exceeds\nthe VAT inode size, the s_num_entries subtraction underflows to a huge\ncount, which defeats the \"block > s_num_entries\" bound in\nudf_get_pblock_virt15(); and on the ICB-inline path that function reads\n\n\t((__le32 *)(iinfo->i_data + s_start_offset))[block]\n\nso a large s_start_offset indexes past the inode's in-ICB data.  Mounting\na crafted UDF image with a virtual (VAT) partition then triggers an\nout-of-bounds read.\n\nReject a VAT whose header length does not leave room for at least one\nentry within the VAT inode."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/udf/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934","versionType":"git","status":"affected"},{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"883962731420ec271ed8c1cd76524f4b17faa982","versionType":"git","status":"affected"},{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63","versionType":"git","status":"affected"},{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb","versionType":"git","status":"affected"},{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"55287a3555ff0515b3aff181d2c08c0462a41709","versionType":"git","status":"affected"},{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad","versionType":"git","status":"affected"},{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"74580fdf022909e184223cacc364feb826982d96","versionType":"git","status":"affected"},{"version":"fa5e08156335d0687c85b4e724db9448fb166601","lessThan":"d8202786b3d75125c84ebc4de6d946f92fde0ee8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/udf/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64324","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:13.923","lastModified":"2026-07-27T05:16:42.513","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate free block extents against the partition length\n\nudf_free_blocks() checks the logical block number and count against the\npartition length, but drops the extent offset from that final bound.  A\ncrafted extent can pass the guard while logicalBlockNum + offset + count\npoints past the partition, which later indexes past the space bitmap\narray.\n\nA single ftruncate(2) on a file backed by such an extent reliably\npanics the kernel.  This is a local availability issue.  On desktop\nsystems where UDisks/polkit allows the active user to mount removable\nUDF media without CAP_SYS_ADMIN, an unprivileged local user can supply\nthe crafted filesystem and trigger the panic by truncating a writable\nfile on it.  Systems that require root or CAP_SYS_ADMIN to mount the\nimage have a higher prerequisite.\n\nNo confidentiality or integrity impact is claimed: the reproduced\nprimitive is an out-of-bounds read of a bitmap pointer slot followed by\na kernel panic.\n\nUse the already computed logicalBlockNum + offset + count value for the\npartition length check.  Also make load_block_bitmap() reject an\nout-of-range block group before indexing s_block_bitmap[], so corrupted\ncallers cannot walk past the flexible array."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/udf/balloc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"934f815345c09c290a9b9a9cfdddc203ec2117e8","lessThan":"fdd6229d2ae9914c1f25d1041db0f4f312a4fa76","versionType":"git","status":"affected"},{"version":"22cc7323f090646c8cfb5939e6f15bdc2ed3fd27","lessThan":"b54aee5652fcd7c23a0904a4623ec462c3edc70c","versionType":"git","status":"affected"},{"version":"7c4fa9ebfce69619d132fe703dc2e2cf62a13723","lessThan":"12af328d2ee8d68e81ba612246d0b54b22d23e1f","versionType":"git","status":"affected"},{"version":"5cc9745e2ea11aef7d5c9a42bc36f6cd3e1b4cc3","lessThan":"fb49099206c5c57af28a157249fa7bcb5518f99e","versionType":"git","status":"affected"},{"version":"56e69e59751d20993f243fb7dd6991c4e522424c","lessThan":"9442d75429b0c556292a7454fe888d54259f5240","versionType":"git","status":"affected"},{"version":"56e69e59751d20993f243fb7dd6991c4e522424c","lessThan":"335202ab25b01fdd45889ff25eab70864686dea3","versionType":"git","status":"affected"},{"version":"56e69e59751d20993f243fb7dd6991c4e522424c","lessThan":"be87de7789a82a030a4896bc7683415ec9fa6f2b","versionType":"git","status":"affected"},{"version":"56e69e59751d20993f243fb7dd6991c4e522424c","lessThan":"5f0419457f89dce1a3f1c8e62a3adf2f39ab8168","versionType":"git","status":"affected"},{"version":"097420e48e30f51e8f4f650b5c946f5af63ec1a3","versionType":"git","status":"affected"},{"version":"5def895b42ef16a2da6402818cba8d7ec8ede1ef","versionType":"git","status":"affected"},{"version":"05fb2bf477d3fe5421bd4cb699574737f52bd88b","versionType":"git","status":"affected"},{"version":"5.10.224","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.15.165","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.105","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.46","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"4.19.320","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.282","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"6.10.5","lessThan":"6.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/udf/balloc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdd6229d2ae9914c1f25d1041db0f4f312a4fa76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64333","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:15.080","lastModified":"2026-07-27T05:16:42.670","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix write buffer corruption\n\nThe digi_write_inb_command() is supposed to wait for the write urb to\nbecome available or return an error, but instead it updates the transfer\nbuffer and tries to resubmit the urb on timeout.\n\nTo make things worse, for commands like break control where no timeout\nis used, the driver would corrupt the urb immediately due to a broken\njiffies comparison (on 32-bit machines this takes five minutes of uptime\nto trigger due to INITIAL_JIFFIES).\n\nFix this by adding the missing return on timeout and waiting\nindefinitely when no timeout has been specified as intended.\n\nThis issue was (sort of) flagged by Sashiko when reviewing an unrelated\nchange to the driver."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/serial/digi_acceleport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5d9dc88bdf8897788b0eed57113e9eca7fd42ea9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2f296974acc279f05f284441bfe3064074958d11","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e60e4873e9178da9f4f2674e4c2ff085d5a84f79","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"699dfb6917503b3cda4d5da6941cf79c3c1b4c8b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a274b3794fe1852c3d9fe6d900b94053c0b03410","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1243f120790042c2ac92e84e797dacc75fff4366","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a3a13fdc53103b07335918e2cdeb465038a71725","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/serial/digi_acceleport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1243f120790042c2ac92e84e797dacc75fff4366","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f296974acc279f05f284441bfe3064074958d11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d9dc88bdf8897788b0eed57113e9eca7fd42ea9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/699dfb6917503b3cda4d5da6941cf79c3c1b4c8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a274b3794fe1852c3d9fe6d900b94053c0b03410","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3a13fdc53103b07335918e2cdeb465038a71725","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e60e4873e9178da9f4f2674e4c2ff085d5a84f79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64346","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:16.757","lastModified":"2026-07-27T05:16:42.813","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: Fix use-after-free in gadget_match_driver\n\nThe udc structure acts as the management structure for the gadget,\nbut their lifecycles are decoupled. A race condition exists where\nusb_del_gadget() frees the udc memory (e.g., via mode-switch work)\nwhile gadget_match_driver() concurrently accesses the freed udc memory\n(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a\nNULL pointer dereference when the freed memory is zeroed:\n\n[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140\n[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60\n...\n[39430.911890][ T1171]  usb_gadget_register_driver_owner+0x50/0xf8\n[39430.911910][ T1171]  gadget_dev_desc_UDC_store+0xf4/0x140\n[39430.931308][ T1171]  configfs_write_iter+0xec/0x134\n\n[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode\n[39430.957287][ T1171]  dwc3_gadget_exit+0x34/0x8c\n[39430.957304][ T1171]  __dwc3_set_mode+0xc0/0x664\n\nFix this by ensuring the udc structure remains allocated until the\ngadget is released. To achieve this, introduce a new\nusb_gadget_release() routine to the core. When the gadget is added,\nusb_add_gadget() stores the gadget's release routine in the udc\nstructure and takes a reference to the udc. When the gadget is\nreleased, usb_gadget_release() drops the reference to the udc and\nthen calls the gadget's release routine."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/udc/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","lessThan":"50eeb8e8a4f389efc91b93cff14a683e714ec194","versionType":"git","status":"affected"},{"version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","lessThan":"7a5214dae906d9f58e07bc4995e8181ee74439f4","versionType":"git","status":"affected"},{"version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","lessThan":"d026f71df141c9b064ff32a78af5391a31ef75c2","versionType":"git","status":"affected"},{"version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","lessThan":"b52476a83d9e12df00765359d728a875b128bef1","versionType":"git","status":"affected"},{"version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","lessThan":"54fa390aae393eb130f307a85562e3001cc39a52","versionType":"git","status":"affected"},{"version":"fc274c1e997314bf47f6a62c79b5d7e554ed59c4","lessThan":"67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/udc/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64354","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:17.810","lastModified":"2026-07-27T05:16:42.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Validate BTF repeated field counts before expansion\n\nbtf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD,\nand btf_repeat_fields() expands repeatable fields from array elements\ninto the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields().\n\nThe remaining-capacity check performs the expanded field count calculation\nin u32. A malformed BTF can wrap that calculation, causing the check to\npass even when the expanded field count exceeds the scratch array\ncapacity. The following memcpy() can then write past the end of the\narray.\n\nUse checked addition and multiplication before copying repeated fields\nand reject impossible counts."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"797d73ee232dd1833dec4824bc53a22032e97c1c","lessThan":"c5ff816d5f13900c3f1f3298cfcc61339e056e56","versionType":"git","status":"affected"},{"version":"797d73ee232dd1833dec4824bc53a22032e97c1c","lessThan":"cd407de2ef5dc70f1970b343ffaa16186340fdfd","versionType":"git","status":"affected"},{"version":"797d73ee232dd1833dec4824bc53a22032e97c1c","lessThan":"ff77d013b737c0f77d925e2f2c59f0cf3d76bd35","versionType":"git","status":"affected"},{"version":"797d73ee232dd1833dec4824bc53a22032e97c1c","lessThan":"b9452b594fd3aecbfd4aa0a6a1f741330a37dab7","versionType":"git","status":"affected"},{"version":"6f957d972feee9b385ea3ae6530310a84e55ba71","versionType":"git","status":"affected"},{"version":"6.11.6","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/btf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/b9452b594fd3aecbfd4aa0a6a1f741330a37dab7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5ff816d5f13900c3f1f3298cfcc61339e056e56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd407de2ef5dc70f1970b343ffaa16186340fdfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff77d013b737c0f77d925e2f2c59f0cf3d76bd35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64355","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:17.920","lastModified":"2026-07-27T05:16:43.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject fragmented frames in devmap\n\nDevmap broadcast redirects clone the packet for all but the last\ndestination.\n\nFor native XDP, that clone path copies only the linear xdp_frame data,\nwhile fragmented frames keep skb_shared_info in tailroom outside the\nlinear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but\nwithout valid frag metadata, and the later free path can interpret\nuninitialized tail data as skb_shared_info, leading to an out-of-bounds\naccess during frame return.\n\nReject fragmented native XDP frames in dev_map_enqueue_clone().\n\nAdd the same restriction to the generic XDP clone path in\ndev_map_redirect_clone(). Generic XDP represents fragmented packets as\nnonlinear skbs, and rejecting them here keeps clone-based broadcast\nsupport aligned between native and generic XDP."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/devmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e624d4ed4aa8cc3c69d1359b0aaea539203ed266","lessThan":"47baddc856ae7e93a565dd9deeb797999b179466","versionType":"git","status":"affected"},{"version":"e624d4ed4aa8cc3c69d1359b0aaea539203ed266","lessThan":"07a4c11ee8ef4abcb39d922e9e410ae269671cdf","versionType":"git","status":"affected"},{"version":"e624d4ed4aa8cc3c69d1359b0aaea539203ed266","lessThan":"bccbab36ff228e0825eb85d9b0f9b8434cd0a399","versionType":"git","status":"affected"},{"version":"e624d4ed4aa8cc3c69d1359b0aaea539203ed266","lessThan":"c5b4f5efcb55c1af3fe44ff712d31b7fb098a831","versionType":"git","status":"affected"},{"version":"e624d4ed4aa8cc3c69d1359b0aaea539203ed266","lessThan":"a9bb2d9c798cb62a4050a991c27b752770c33afe","versionType":"git","status":"affected"},{"version":"e624d4ed4aa8cc3c69d1359b0aaea539203ed266","lessThan":"51d07c12ca411e692c424ecdabf077f1e61a61be","versionType":"git","status":"affected"},{"version":"e624d4ed4aa8cc3c69d1359b0aaea539203ed266","lessThan":"aa496720618f1a6054f1c870bf10b4f6c99bf656","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/devmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/07a4c11ee8ef4abcb39d922e9e410ae269671cdf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47baddc856ae7e93a565dd9deeb797999b179466","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51d07c12ca411e692c424ecdabf077f1e61a61be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9bb2d9c798cb62a4050a991c27b752770c33afe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa496720618f1a6054f1c870bf10b4f6c99bf656","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bccbab36ff228e0825eb85d9b0f9b8434cd0a399","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5b4f5efcb55c1af3fe44ff712d31b7fb098a831","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64361","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:18.677","lastModified":"2026-07-27T05:16:43.193","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: fix u32 overflow in check_and_correct_requested_length\n\ncheck_and_correct_requested_length() compares (off + len) against\nnode_size using u32 arithmetic.  When the caller passes a large len\nvalue (e.g. from an underflowed subtraction in hfs_brec_remove()),\noff + len can wrap past 2^32 and produce a small result, causing the\nbounds check to pass when it should fail.\n\nFor example, with off=14 and len=0xFFFFFFF2 (underflowed from\ndata_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,\nwhich is less than a typical node_size of 512, so the check passes and\nthe subsequent memmove reads ~4GB past the node buffer.\n\nFix this by widening the addition to u64 before comparing against\nnode_size.  This prevents the u32 wrap while keeping the logic\nstraightforward."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/hfs/bnode.c","fs/hfsplus/hfsplus_fs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"67ecc81f6492275c9c54280532f558483c99c90e","lessThan":"c8dd112173c02adf539fe2ad34a45f5e0068780d","versionType":"git","status":"affected"},{"version":"a1a60e79502279f996e55052f50cc14919020475","lessThan":"fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1","versionType":"git","status":"affected"},{"version":"fe2891a9c43ab87d1a210d61e6438ca6936e2f62","lessThan":"671c3fcc2ad31c1311ea6414382a2d95104ae1b9","versionType":"git","status":"affected"},{"version":"384a66b89f9540a9a8cb0f48807697dfabaece4c","lessThan":"b6a481642ea1977be2f84dc08c5affd742c177e7","versionType":"git","status":"affected"},{"version":"efc095b35b23297e419c2ab4fc1ed1a8f0781a29","lessThan":"7399c3baee7bb622a92f0b895cd4d3009a693f2b","versionType":"git","status":"affected"},{"version":"a431930c9bac518bf99d6b1da526a7f37ddee8d8","lessThan":"607217f7ad419b53926f71e3f75001813bbc08ad","versionType":"git","status":"affected"},{"version":"a431930c9bac518bf99d6b1da526a7f37ddee8d8","lessThan":"c25d3c931a63e762fcaa9cb125b901c53b62403f","versionType":"git","status":"affected"},{"version":"a431930c9bac518bf99d6b1da526a7f37ddee8d8","lessThan":"966cb76fb2857a4242cab6ea2ea17acf818a3da7","versionType":"git","status":"affected"},{"version":"e7d2dc2421e821e4045775e6dc226378328de6f6","versionType":"git","status":"affected"},{"version":"fc7f732984ec91f30be3e574e0644066d07f2b78","versionType":"git","status":"affected"},{"version":"eec522fd0d28106b14a59ab2d658605febe4a3bb","versionType":"git","status":"affected"},{"version":"5.10.241","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.15.190","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.149","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.103","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.43","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"5.4.297","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"6.15.11","lessThan":"6.16","versionType":"semver","status":"affected"},{"version":"6.16.2","lessThan":"6.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/hfs/bnode.c","fs/hfsplus/hfsplus_fs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64364","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:19.110","lastModified":"2026-07-27T05:16:43.347","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td->maxcontacts, which is taken from the device's\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i < mt->num_slots; i++)\n\t\tclear_bit(i, &td->mt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td->applications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags & MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td->active_slots, td->maxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hid/hid-multitouch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fc488f675344931ffab6a51c43691065ec006567","lessThan":"12e90656e330ff8bbaf2f29c535fdb8a11cc6f55","versionType":"git","status":"affected"},{"version":"77711d850bed75ae7142c3d1f22c1a8b4d049c33","lessThan":"152983d87387f6a8ae72b73474cfa55fbcf1ec75","versionType":"git","status":"affected"},{"version":"6acfe25968913788d30ec0eedd80178c4ea3f1d0","lessThan":"b5c037d6b807017e74a115288f81bc9cd5a5aab8","versionType":"git","status":"affected"},{"version":"d280c138e66be87d1fccfed42593f02fdb893905","lessThan":"a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d","versionType":"git","status":"affected"},{"version":"f32fea4c0234c971c12e46d76612cdc2dd4bb046","lessThan":"e24918ee67c4dc3d20d4670750e46e9b160365f4","versionType":"git","status":"affected"},{"version":"46f781e0d151844589dc2125c8cce3300546f92a","lessThan":"37daa8c96bd563d03150e23f094cb60703594a6d","versionType":"git","status":"affected"},{"version":"46f781e0d151844589dc2125c8cce3300546f92a","lessThan":"6493ebf9489efef0105078377b973ab33d51af22","versionType":"git","status":"affected"},{"version":"46f781e0d151844589dc2125c8cce3300546f92a","lessThan":"8813b0612275cc61fe9e6603d0ee019247ade6be","versionType":"git","status":"affected"},{"version":"59bd04163e6451b9c7275277882ed9f4abfa2051","versionType":"git","status":"affected"},{"version":"5.10.246","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.15.196","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.158","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.114","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.55","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.17.5","lessThan":"6.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hid/hid-multitouch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64366","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:19.403","lastModified":"2026-07-27T05:16:43.517","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert\n\nwacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo\ndoesn't have enough space for the incoming report. If the kfifo is\nempty, kfifo_skip() reads stale data left in the kmalloc'd buffer\nvia __kfifo_peek_n() and interprets it as a record length, advancing\nfifo->out by that garbage value. This corrupts the internal kfifo\nstate, causing kfifo_unused() to return a value much larger than the\nactual buffer size, which bypasses __kfifo_in_r()'s guard:\n\n  if (len + recsize > kfifo_unused(fifo))\n      return 0;\n\nkfifo_copy_in() then performs an out-of-bounds memcpy, writing up to\n3842 bytes past the 256-byte buffer.\n\nAdd a !kfifo_is_empty() condition to the while loop so kfifo_skip()\nis never called on an empty fifo, and check the return value of\nkfifo_in() to reject reports that are too large for the fifo."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hid/wacom_sys.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5e013ad206895e72d7da41bc1ae89d8cb499c3aa","lessThan":"ca899a926c11a59211b764b0155d9a1cdcc32b81","versionType":"git","status":"affected"},{"version":"5e013ad206895e72d7da41bc1ae89d8cb499c3aa","lessThan":"57bdd10ad50d68341f500a7b330f0d8949e510ec","versionType":"git","status":"affected"},{"version":"5e013ad206895e72d7da41bc1ae89d8cb499c3aa","lessThan":"6b3014ec0e9a390ca563030b2d7689921f0daef5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hid/wacom_sys.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/57bdd10ad50d68341f500a7b330f0d8949e510ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b3014ec0e9a390ca563030b2d7689921f0daef5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca899a926c11a59211b764b0155d9a1cdcc32b81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64367","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:19.510","lastModified":"2026-07-27T05:16:43.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-goodix-spi: validate report size to prevent stack buffer overflow\n\ngoodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack\nbuffer (tmp_buf), writing an 11-12 byte header followed by the\ncaller-supplied report data.  The HID core caps report size at\nHID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set\nhid_ll_driver.max_buffer_size and performs no bounds checking before\ncopying the payload:\n\n    memcpy(tmp_buf + tx_len, buf, len);\n\nA hidraw SET_REPORT ioctl with a report larger than ~116 bytes\noverflows the stack buffer.\n\nAdd a size check after constructing the header, rejecting reports that\nwould exceed the buffer capacity.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hid/hid-goodix-spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"75e16c8ce283bb88e77704dc8fa041c577caac0f","lessThan":"ad47ad624f2fce0bc44bbadb664242461a97d774","versionType":"git","status":"affected"},{"version":"75e16c8ce283bb88e77704dc8fa041c577caac0f","lessThan":"dae1d000ddfd5c2140b036e47fff0c497ae9c64b","versionType":"git","status":"affected"},{"version":"75e16c8ce283bb88e77704dc8fa041c577caac0f","lessThan":"835fcc8655569737e3f057d42875a96259db74c2","versionType":"git","status":"affected"},{"version":"75e16c8ce283bb88e77704dc8fa041c577caac0f","lessThan":"db0a0768d09273aadadeb76730cd658d720333a4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hid/hid-goodix-spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/835fcc8655569737e3f057d42875a96259db74c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad47ad624f2fce0bc44bbadb664242461a97d774","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dae1d000ddfd5c2140b036e47fff0c497ae9c64b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db0a0768d09273aadadeb76730cd658d720333a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64368","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:19.613","lastModified":"2026-07-27T05:16:43.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: do not limit zeroing to orig_size when only red zoning is enabled\n\nWhen init (zeroing) on allocation is requested, for kmalloc() we\ngenerally have to zero the full object size even if a smaller size is\nrequested, in order to provide krealloc()'s __GFP_ZERO guarantees.\n\nBut if we track the requested size, krealloc() uses that information to\ndo the right thing, so we can zero only the requested size. With red\nzoning also enabled, any extra size became part of the red zone, so it\nmust not be zeroed and thus we must zero only the requested size.\n\nHowever the current check is imprecise, and will trigger also when only\nSLAB_RED_ZONE is enabled without SLAB_STORE_USER (which enables tracking\nthe requested size). This means enabling red zoning alone can compromise\nkrealloc()'s __GFP_ZERO contract.\n\nFix this by using slub_debug_orig_size() instead, which is the exact\ncheck for whether the requested size is tracked. We don't need to care\nif red zoning is also enabled or not. Also update and expand the\ncomment accordingly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/slub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9ce67395f5a0cdec6ce152d26bfda13b98b25c01","lessThan":"6256899c3a34674bba6076884aedbba49fc695e4","versionType":"git","status":"affected"},{"version":"9ce67395f5a0cdec6ce152d26bfda13b98b25c01","lessThan":"7e706d50fa119eead6376bf0ef973e8d73a96030","versionType":"git","status":"affected"},{"version":"9ce67395f5a0cdec6ce152d26bfda13b98b25c01","lessThan":"2382971aaaef5bf85a651234c64906f59580b8be","versionType":"git","status":"affected"},{"version":"9ce67395f5a0cdec6ce152d26bfda13b98b25c01","lessThan":"0d18ccef142f04433dfb2a0c120cf223d2b8a42c","versionType":"git","status":"affected"},{"version":"9ce67395f5a0cdec6ce152d26bfda13b98b25c01","lessThan":"648927ceb84021a25a0fbd5673740956f318d534","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/slub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0d18ccef142f04433dfb2a0c120cf223d2b8a42c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2382971aaaef5bf85a651234c64906f59580b8be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6256899c3a34674bba6076884aedbba49fc695e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/648927ceb84021a25a0fbd5673740956f318d534","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e706d50fa119eead6376bf0ef973e8d73a96030","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64372","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:20.147","lastModified":"2026-07-27T05:16:43.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: pcc: fix use-after-free and double free in _OSC evaluation\n\npcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the\ntwo-phase _OSC negotiation. Between the two calls it freed\noutput.pointer but left output.length unchanged. Since\nacpi_evaluate_object() treats a non-zero length with a non-NULL\npointer as an existing buffer to write into, the second call wrote\ninto freed memory (use-after-free). The subsequent kfree(output.pointer)\nat out_free then freed the same pointer a second time (double free).\n\nReset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER\nafter freeing the first result, so ACPICA allocates a fresh buffer for\neach phase independently."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/cpufreq/pcc-cpufreq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"8e454e9d0bc03446d610ee49abec9dfd424f6541","versionType":"git","status":"affected"},{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"632666a63116d8061c62a988d1ca39dcd6d27c9b","versionType":"git","status":"affected"},{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"5cdb25f144b101083d8bf3fd023ad87fbe6850d7","versionType":"git","status":"affected"},{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"982c9f92d57bda2b769851ff6d90d43dcf5f3734","versionType":"git","status":"affected"},{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"a36ca93a8ba57464e521d70a337d37f069064111","versionType":"git","status":"affected"},{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7","versionType":"git","status":"affected"},{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29","versionType":"git","status":"affected"},{"version":"0f1d683fb35d6c6f49ef696c95757f3970682a0e","lessThan":"266d3dd8b757b48a576e90f018b51f7b7563cc32","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/cpufreq/pcc-cpufreq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/266d3dd8b757b48a576e90f018b51f7b7563cc32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5cdb25f144b101083d8bf3fd023ad87fbe6850d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/632666a63116d8061c62a988d1ca39dcd6d27c9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e454e9d0bc03446d610ee49abec9dfd424f6541","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/982c9f92d57bda2b769851ff6d90d43dcf5f3734","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a36ca93a8ba57464e521d70a337d37f069064111","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64374","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:20.433","lastModified":"2026-07-27T05:16:44.083","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT\n\nRT migration is done aggressively. When a CPU schedules out a high\npriority RT task for a lower priority task, it will look to see if there's\nany RT tasks that are waiting to run on another CPU that is of higher\npriority than the task this CPU is about to run. If it finds one, it will\npull that task over to the CPU and allow it to run there instead.\n\nNormally, this pulling is done by looking at the RT overloaded mask (rto)\nwhich contains all the CPUs in the scheduler domain with RT tasks that are\nwaiting to run due to a higher priority RT task currently running on their\nCPU. The CPU that is about to schedule a lower priority task will grab the\nrq lock of the overloaded CPU and move the RT task from that CPU's runqueue\nto the local one and schedule the higher priority RT task.\n\nThis caused issues when a lot of CPUs would schedule a lower priority task\nat the same time. They would all try to grab the same runqueue lock of\nthe CPU with the overloaded RT tasks. Only the first CPU that got in will\nget that task. All the others would wait until they got the runqueue lock\nand see there's nothing to pull and do nothing. On systems with lots of\nCPUs, this caused a large latency (up to 500us) which is beyond what\nPREEMPT_RT is to allow.\n\nThe solution to that was to create an RT_PUSH_IPI logic. When any CPU\nwanted to pull a task, instead of grabbing the runqueue lock of the\noverloaded CPU, it would start by sending an IPI to the overloaded CPU,\nand that IPI handler would have the CPU with the waiting RT task do a push\ninstead. Then that handler would send an IPI to the next CPU with\noverloaded RT tasks, and so on. Note, after the first CPU starts this\nprocess, if another CPU wanted to do a pull, it would see that the process\nhas already begun and would only increment a counter to have the IPIs\ncontinue again.\n\nThe RT_PUSH_IPI solved the latency problem with PREEMPT_RT but could cause\na new issue with non PREEMPT_RT. Namely, softirqs run in a threaded\ncontext on PREEMPT_RT but they can run in an interrupt context in non-RT.\n\nIf an IPI lands on a CPU that has just woken up multiple RT tasks and the\ncurrent CPU is running a non RT or a low priority RT task, instead of\ndoing a push, it would simply do a schedule on that CPU. But if a softirq\nwas also executing on this CPU, the schedule would need to wait until the\nsoftirq finished. Until then, the CPU would still be considered overloaded\nas there are RT tasks still waiting to run on it.\n\nA live lock occurred on a workload that was doing heavy networking traffic\non a large machine where the softirqs would run 500us out of 750us. And it\nwould also be waking up RT tasks, causing the RT pull logic to be\nconstantly executed.\n\nWhen a softirq triggered on a CPU with RT tasks queued but not running\nyet, and the other CPUs would see this CPU as being overloaded, they would\nsend an IPI over to it. The CPU would notice that the waiting RT tasks are\nof higher priority than the currently running task and simply schedule\nthat CPU instead. But because the softirq was executing, before it could\nschedule, it would receive another IPI to do the same. The amount of IPIs\nwould slow down the currently running softirq so much that before it could\nreturn back to task context, it would execute another softirq never\nallowing the CPU to schedule. This live locked that CPU.\n\nAs RT_PUSH_IPI was created to help PREEMPT_RT, make it default off if\nPREEMPT_RT is not enabled."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/features.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"b99f04ae3d200d2f8844aa29145bd18eccbeecde","versionType":"git","status":"affected"},{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"d8312a56d9a162e3ec76476aa487e7d20bc602e9","versionType":"git","status":"affected"},{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"44aae426dbfd51286f7eb601cfa14bc32164812a","versionType":"git","status":"affected"},{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"860aaff72c8446fed5e576249e19952883a18885","versionType":"git","status":"affected"},{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"89237c8fc15d8016a194076e648ccb57d75e65ae","versionType":"git","status":"affected"},{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"4bd0da48fbc1dbef6774175129107fbbdd353e26","versionType":"git","status":"affected"},{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"a18f80bf5359238c4f067d691b96af00286fdd89","versionType":"git","status":"affected"},{"version":"b6366f048e0caff28af5335b7af2031266e1b06b","lessThan":"dd29c017aed628076e915fe4cdfb5392fd4c5cab","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/features.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/44aae426dbfd51286f7eb601cfa14bc32164812a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4bd0da48fbc1dbef6774175129107fbbdd353e26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/860aaff72c8446fed5e576249e19952883a18885","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89237c8fc15d8016a194076e648ccb57d75e65ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a18f80bf5359238c4f067d691b96af00286fdd89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b99f04ae3d200d2f8844aa29145bd18eccbeecde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8312a56d9a162e3ec76476aa487e7d20bc602e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd29c017aed628076e915fe4cdfb5392fd4c5cab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64375","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:20.593","lastModified":"2026-07-27T05:16:44.250","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nproc: protect ptrace_may_access() with exec_update_lock (FD links)\n\nproc_pid_get_link() and proc_pid_readlink() currently look up the task from\nthe pid once, then do the ptrace access check on that task, then look up\nthe task from the pid a second time to do the actual access.\nThat's racy in several ways.\n\nTo fix it, pass the task to the ->proc_get_link() handler, and instead of\nproc_fd_access_allowed(), introduce a new helper call_proc_get_link() that\nlooks up and locks the task, does the access check, and calls\n->proc_get_link()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/proc/base.c","fs/proc/fd.c","fs/proc/internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"6253dfee5afba536bb54fc6fe6c091c3758fafe1","versionType":"git","status":"affected"},{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"65bf0d2b6e914f1448d6a2fde193dcf60936a651","versionType":"git","status":"affected"},{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf","versionType":"git","status":"affected"},{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2","versionType":"git","status":"affected"},{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"83b17872e3166c295c599279fc9562ac3840c638","versionType":"git","status":"affected"},{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"497c6bae5167428596575f20af6613ff5671f383","versionType":"git","status":"affected"},{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"dfd1894cb64cbd8758b461ed713800fe73db4f82","versionType":"git","status":"affected"},{"version":"778c1144771f0064b6f51bee865cceb0d996f2f9","lessThan":"6255da28d4bb5349fe18e84cb043ccd394eba75d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/proc/base.c","fs/proc/fd.c","fs/proc/internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.18","status":"affected"},{"version":"0","lessThan":"2.6.18","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/497c6bae5167428596575f20af6613ff5671f383","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6253dfee5afba536bb54fc6fe6c091c3758fafe1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6255da28d4bb5349fe18e84cb043ccd394eba75d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65bf0d2b6e914f1448d6a2fde193dcf60936a651","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83b17872e3166c295c599279fc9562ac3840c638","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfd1894cb64cbd8758b461ed713800fe73db4f82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64378","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:20.940","lastModified":"2026-07-27T05:16:44.393","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: fix race between cgroup_writeback_umount() and inode_switch_wbs()\n\nWhen a container exits, the following BUG_ON() is occasionally triggered:\n\n==================================================================\n VFS: Busy inodes after unmount of sdb (ext4)\n ------------[ cut here ]------------\n kernel BUG at fs/super.c:695!\n CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1\n pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : generic_shutdown_super+0xf0/0x100\n lr : generic_shutdown_super+0xf0/0x100\n Call trace:\n  generic_shutdown_super+0xf0/0x100\n  kill_block_super+0x20/0x48\n  ext4_kill_sb+0x28/0x60\n  deactivate_locked_super+0x54/0x130\n  deactivate_super+0x84/0xa0\n  cleanup_mnt+0xa4/0x140\n  __cleanup_mnt+0x18/0x28\n  task_work_run+0x78/0xe0\n  do_notify_resume+0x204/0x240\n==================================================================\n\nThe root cause is a race between cgroup_writeback_umount() and\ninode_switch_wbs()/cleanup_offline_cgwb(). There is a window between\ninode_prepare_wbs_switch() returning true and the subsequent\nwb_queue_isw() call. Following is the process that triggers the issue:\n\n      CPU A (umount)           |          CPU B (writeback)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n                                 inode_switch_wbs/cleanup_offline_cgwb\n                                  atomic_inc(&isw_nr_in_flight)\n                                  inode_prepare_wbs_switch\n                                   -> passes SB_ACTIVE check\n                                   __iget(inode)\n generic_shutdown_super\n  sb->s_flags &= ~SB_ACTIVE\n  cgroup_writeback_umount(sb)\n   smp_mb()\n   atomic_read(&isw_nr_in_flight)\n   rcu_barrier()\n    -> no pending RCU callbacks\n   flush_workqueue(isw_wq)\n    -> nothing queued, returns\n  evict_inodes(sb)\n   -> Inode skipped as isw still holds a ref.\n  sop->put_super(sb)\n   /* destroys percpu counters */\n  -> VFS: Busy inodes after unmount!\n                                  wb_queue_isw()\n                                   queue_work(isw_wq, ...)\n                                  /* later in work function */\n                                  inode_switch_wbs_work_fn\n                                   process_inode_switch_wbs\n                                    iput() -> evict\n                                     percpu_counter_dec() // UAF!\n\nFix this by extending the RCU read-side critical section in\ninode_switch_wbs() and cleanup_offline_cgwb() to cover from\ninode_prepare_wbs_switch() through wb_queue_isw().  Since there is\nno sleep in this window, rcu_read_lock() can be used.  Then add a\nsynchronize_rcu() in cgroup_writeback_umount() before the existing\nrcu_barrier(), so that all in-flight switchers that have passed the\nSB_ACTIVE check have completed queue_work() before flush_workqueue()\nis called.\n\nThe existing rcu_barrier() is intentionally retained so this fix can\nbe backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that\nstill queue switches via queue_rcu_work(). It is a no-op on current\nmainline (since commit e1b849cfa6b6 (\"writeback: Avoid contention on\nwb->list_lock when switching inodes\")) and is removed in a follow-up\npatch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fs-writeback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a1a0e23e49037c23ea84bc8cc146a03584d13577","lessThan":"087d5b8b501c570f84bf655164e6698c3ce146e0","versionType":"git","status":"affected"},{"version":"a1a0e23e49037c23ea84bc8cc146a03584d13577","lessThan":"3c9c9648f77e4d14e50676bc51c2174ba9c8d361","versionType":"git","status":"affected"},{"version":"a1a0e23e49037c23ea84bc8cc146a03584d13577","lessThan":"5c3265f3252b2ee50707adaaa3f9bd0df3df72de","versionType":"git","status":"affected"},{"version":"a1a0e23e49037c23ea84bc8cc146a03584d13577","lessThan":"c923cc3cb5cd8945ceaf08252754110643446593","versionType":"git","status":"affected"},{"version":"a1a0e23e49037c23ea84bc8cc146a03584d13577","lessThan":"685fc15a410885b6d4dee64de0dce721b9428b12","versionType":"git","status":"affected"},{"version":"a1a0e23e49037c23ea84bc8cc146a03584d13577","lessThan":"53eeaf4d63068dbc7708b0c7adb20151c812feca","versionType":"git","status":"affected"},{"version":"a1a0e23e49037c23ea84bc8cc146a03584d13577","lessThan":"cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d","versionType":"git","status":"affected"},{"version":"c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339","versionType":"git","status":"affected"},{"version":"4.4.5","lessThan":"4.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fs-writeback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64379","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:21.090","lastModified":"2026-07-27T05:16:44.557","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: mask server-provided mode to 07777 in modefromsid\n\nWhen modefromsid is active, parse_dacl() applies the server-provided\nsub_auth[2] value from the NFS mode SID to cf_mode without masking to\n07777. Apply the correct masking, same as in the read path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14","versionType":"git","status":"affected"},{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"ee2216dbdf0c677e89bb43e03247dba590ed00ef","versionType":"git","status":"affected"},{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"f511807feee7cb29b61bdfa86472c7e9e2e5df94","versionType":"git","status":"affected"},{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"08c600b7e1818539ba5efee4cdb06215c245ca78","versionType":"git","status":"affected"},{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d","versionType":"git","status":"affected"},{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"c6c484a7d5bff6b929a86d7ed5130f29834c6a0d","versionType":"git","status":"affected"},{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"f80add1bfb3425100a325b14f19648e75669a954","versionType":"git","status":"affected"},{"version":"e2f8fbfb8d09c06decde162090fac3ee220aa280","lessThan":"e3d9c7160d483fc8f9e225aafad8ecbbc43f3151","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f80add1bfb3425100a325b14f19648e75669a954","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64380","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:21.220","lastModified":"2026-07-27T05:16:44.690","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: harden POSIX SID length parsing\n\nposix_info_sid_size() reads sid[1] to obtain the subauthority count,\nbut its existing boundary check still accepts buffers with only one\nremaining byte. Require two bytes before reading sid[1] so all client\npaths that reuse the helper reject truncated POSIX SIDs safely."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"171605aed68380c2fa75dff9b3a1ed427c50065b","versionType":"git","status":"affected"},{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"4213c1208978483021d7d125c131de3985d38f61","versionType":"git","status":"affected"},{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"96e889bc1e759c83f25093e8c2f3da31b4973f30","versionType":"git","status":"affected"},{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"0de5b8e76847f5de26f364a82c6602c4881c30da","versionType":"git","status":"affected"},{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"427eb7eb46425fec845a43e861f3d6e2899cae59","versionType":"git","status":"affected"},{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"86c5d470f5d42e61123b2f4b4f0b91f4eee5b980","versionType":"git","status":"affected"},{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"46a84715a015cb48e1b9c219dc88c03d8a541ea4","versionType":"git","status":"affected"},{"version":"349e13ad30b45998bb9937cfe0b32be6f951976d","lessThan":"7ad2bcf2441430bb2e918fb3ef9a90d775a6e422","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0de5b8e76847f5de26f364a82c6602c4881c30da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/171605aed68380c2fa75dff9b3a1ed427c50065b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4213c1208978483021d7d125c131de3985d38f61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/427eb7eb46425fec845a43e861f3d6e2899cae59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46a84715a015cb48e1b9c219dc88c03d8a541ea4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ad2bcf2441430bb2e918fb3ef9a90d775a6e422","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86c5d470f5d42e61123b2f4b4f0b91f4eee5b980","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96e889bc1e759c83f25093e8c2f3da31b4973f30","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64382","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:21.477","lastModified":"2026-07-27T05:16:44.823","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_open() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_open_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"433042a91f9373241307725b52de573933ffedbf","lessThan":"02bc2896bdc3e29362d6e40d404006944a159c25","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"3196b5192f246df4272072f61a2f4a3e9967f55d","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"14498ff5ce0f272ce0ef988721413e06b7038972","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"ff2d30927bc3bf3c629f0768d2068096e64ef5ce","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"b55e182f2324bc6a604c21a47aa6c448f719a532","versionType":"git","status":"affected"},{"version":"6.6.32","lessThan":"6.6.145","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/02bc2896bdc3e29362d6e40d404006944a159c25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/14498ff5ce0f272ce0ef988721413e06b7038972","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3196b5192f246df4272072f61a2f4a3e9967f55d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b55e182f2324bc6a604c21a47aa6c448f719a532","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff2d30927bc3bf3c629f0768d2068096e64ef5ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64383","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:21.587","lastModified":"2026-07-27T05:16:44.947","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_flush() replay\n\nSMB2_flush() keeps its response buffer bookkeeping across replay\nattempts. If a replayable flush response is received and the retry then\nfails before cifs_send_recv() stores a replacement response, flush_exit\nwill free the stale response pointer a second time.\n\nReinitialize resp_buftype and rsp_iov at the top of the replay loop so\ncleanup only acts on response state produced by the current attempt.\nThis fixes a double-free without changing replay handling for successful\nrequests."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"433042a91f9373241307725b52de573933ffedbf","lessThan":"6e27f40b682a5e42a2daae3ce6d96f0e0e16dedb","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"878757163eea684750107a31ea134c103863515d","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"3407240cde132a4b72d6429a2625a09a2f78adaf","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"013a9a3da46c5dabcf18f65ea6a47874ba12a15d","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a","versionType":"git","status":"affected"},{"version":"6.6.32","lessThan":"6.6.145","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/013a9a3da46c5dabcf18f65ea6a47874ba12a15d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3407240cde132a4b72d6429a2625a09a2f78adaf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e27f40b682a5e42a2daae3ce6d96f0e0e16dedb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/878757163eea684750107a31ea134c103863515d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64384","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:21.700","lastModified":"2026-07-27T05:16:45.087","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix change notify replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_notify_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"433042a91f9373241307725b52de573933ffedbf","lessThan":"5821f9dbb8b5b24391850a13418e633edd0fb003","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"d684f4134998085702009b94c35c2003fc9e72d3","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"52af1975f0dfae990c5a0e85872cc41be0e88a68","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"901891513951bc8322ece754863909ea45af95c6","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"145f820dcbb2cced374f2532f8a61a44dce4a615","versionType":"git","status":"affected"},{"version":"6.6.32","lessThan":"6.6.145","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/145f820dcbb2cced374f2532f8a61a44dce4a615","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52af1975f0dfae990c5a0e85872cc41be0e88a68","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5821f9dbb8b5b24391850a13418e633edd0fb003","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/901891513951bc8322ece754863909ea45af95c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d684f4134998085702009b94c35c2003fc9e72d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64385","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:21.810","lastModified":"2026-07-27T05:16:45.203","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_ioctl() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_ioctl_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"433042a91f9373241307725b52de573933ffedbf","lessThan":"0be4bc64882edaefaaee8d1e27d083643eb778e6","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"96fcfc8ae7359346156e492ca610e830d2649ad6","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"276c8efbc49f9303ac76d0d4deab7128581b0f3b","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"fc65ffb4ef1bf540da16b17c225ae51091e07d72","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9","versionType":"git","status":"affected"},{"version":"6.6.32","lessThan":"6.6.145","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64386","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:21.917","lastModified":"2026-07-27T05:16:45.323","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query_info() replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_info_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"433042a91f9373241307725b52de573933ffedbf","lessThan":"100fb7c455fa86d248b8bd7bb9de757c192870b4","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"3c81dda84799f76b42aec598564316e2964440db","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"f1add4acb656f5a82806a1ab0e63fed3d8b1bfca","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"89234773e8348918111aa15f6922b58cf3843364","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"2a88561d66eb855813cf004a0abe648bbb17de5e","versionType":"git","status":"affected"},{"version":"6.6.32","lessThan":"6.6.145","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64387","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.020","lastModified":"2026-07-27T05:16:45.450","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query directory replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_directory_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"433042a91f9373241307725b52de573933ffedbf","lessThan":"3409aedf3c81a810243da94164f6621c9d205c98","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"1665f25b1dea30bf2d02e16245d203a944c9d994","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"00b0fa425941438b664950a8ee65dfba2def4336","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"3317a5d015fca976475aa71df224056777316fde","versionType":"git","status":"affected"},{"version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","lessThan":"9647492b5e41954be59d5157eddbcd4cdc1656f7","versionType":"git","status":"affected"},{"version":"6.6.32","lessThan":"6.6.145","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64388","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.127","lastModified":"2026-07-27T05:16:45.570","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix chown/chgrp with SMB3 POSIX Extensions\n\nOwnership (chown) and group (chgrp) modifications were being ignored when\nmounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or\nCIFS_MOUNT_MODE_FROM_SID were also explicitly set.\n\nFix this by checking for posix_extensions in cifs_setattr_nounix() when\nupdating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map\nand set the ownership/group information on the server."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b326614ea2159ea5c835d320f261d05d080cd201","lessThan":"550cfb8a81181331d4d0f76ab75ee58a0bf41e3e","versionType":"git","status":"affected"},{"version":"b326614ea2159ea5c835d320f261d05d080cd201","lessThan":"760ef2c579c2609cf17fb1cd5392f64d42d43d33","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64389","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.227","lastModified":"2026-07-27T05:16:45.683","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate NTLMv2 response before updating session key\n\nksmbd_auth_ntlmv2() derives the NTLMv2 session key into\nsess->sess_key before it verifies the NTLMv2 response.\nksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even\nwhen ksmbd_auth_ntlmv2() failed.\n\nWith SMB3 multichannel binding, the failed authentication operates on\nan existing session and the session setup error path does not expire\nbinding sessions. A client can send a binding session setup with a\nbad NT proof and KEY_XCH and still modify sess->sess_key before\nSTATUS_LOGON_FAILURE is returned.\n\nRelevant path:\n\n  smb2_sess_setup()\n    -> conn->binding = true\n    -> ntlm_authenticate()\n       -> session_user()\n       -> ksmbd_decode_ntlmssp_auth_blob()\n          -> ksmbd_auth_ntlmv2()\n             -> calc_ntlmv2_hash()\n             -> hmac_md5_usingrawkey(..., sess->sess_key)\n             -> crypto_memneq() returns mismatch\n          -> KEY_XCH arc4_crypt(..., sess->sess_key, ...)\n    -> out_err without expiring the binding session\n\nDerive the base session key into a local buffer and copy it to\nsess->sess_key only after the proof matches. Return immediately on\nauthentication failure so KEY_XCH is only processed after successful\nauthentication."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"b56400364aed5c34d6e1a0b493081290a5328a9c","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"89ca7756d5566ba636bb9092cdbe57dab095e136","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"954d196bebb2b50151cb96454c72dc113b2af1ac","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/auth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64390","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.330","lastModified":"2026-07-27T05:16:45.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: track the connection owning a byte-range lock\n\nSMB2_LOCK adds each granted byte-range lock to both the file lock list\nand the lock list of the connection which handled the request.  The\nfinal close and durable handle paths, however, remove the connection\nlist entry while holding fp->conn->llist_lock.\n\nWith SMB3 multichannel, the connection handling the LOCK request can be\ndifferent from the connection which opened the file.  The entry can\ntherefore be removed under a different spinlock from the one protecting\nthe list it belongs to.  A concurrent traversal can then access freed\nstruct ksmbd_lock and struct file_lock objects.\n\nRecord the connection owning each lock's clist entry and hold a\nreference to it while the entry is linked.  Use that connection and its\nllist_lock for unlock, rollback, close, and durable preserve.  Durable\nreconnect assigns the new connection as the owner when publishing the\nlocks again."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f5a544e3bab78142207e0242d22442db85ba1eff","lessThan":"22d38cf75b556c20b039743bdf3654d535b858be","versionType":"git","status":"affected"},{"version":"f5a544e3bab78142207e0242d22442db85ba1eff","lessThan":"66eb3643164e5e1029907793926c132f8b5c6148","versionType":"git","status":"affected"},{"version":"f5a544e3bab78142207e0242d22442db85ba1eff","lessThan":"ea5c9bf99f626a15cc59f645dc895f2b3f01992e","versionType":"git","status":"affected"},{"version":"f5a544e3bab78142207e0242d22442db85ba1eff","lessThan":"fe20d492a69a6f79e637f438072b212e21ed3b78","versionType":"git","status":"affected"},{"version":"f5a544e3bab78142207e0242d22442db85ba1eff","lessThan":"427faaa52b0b399940c1a88065a5c310d10dad15","versionType":"git","status":"affected"},{"version":"f5a544e3bab78142207e0242d22442db85ba1eff","lessThan":"5fecc15a30cb9ebd310f7b52c1ab607edcea78f6","versionType":"git","status":"affected"},{"version":"f5a544e3bab78142207e0242d22442db85ba1eff","lessThan":"c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/22d38cf75b556c20b039743bdf3654d535b858be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/427faaa52b0b399940c1a88065a5c310d10dad15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fecc15a30cb9ebd310f7b52c1ab607edcea78f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66eb3643164e5e1029907793926c132f8b5c6148","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea5c9bf99f626a15cc59f645dc895f2b3f01992e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe20d492a69a6f79e637f438072b212e21ed3b78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64391","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.453","lastModified":"2026-07-27T05:16:45.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for ADS I/O\n\nAlternate data streams are stored as xattrs. Unlike regular file I/O,\ntheir read and write paths therefore call VFS xattr helpers which recheck\ninode permissions and LSM policy using the current task credentials.\n\nRun ADS I/O with the credentials captured when the SMB handle was opened."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"a8f5d39971bbad9340d49cd41b0e2da9452a649d","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"2b4592cea214683de0f2ce6f8c22c097fb0ea1ab","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"52a56cf53ec834c44ac1b4d16d585f26613ee5ce","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"baa5e094886fffa7e6272edcb5e08be5ce28262c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2b4592cea214683de0f2ce6f8c22c097fb0ea1ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52a56cf53ec834c44ac1b4d16d585f26613ee5ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8f5d39971bbad9340d49cd41b0e2da9452a649d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/baa5e094886fffa7e6272edcb5e08be5ce28262c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64392","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.557","lastModified":"2026-07-27T05:16:46.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for delete-on-close\n\nDelete-on-close can be completed by deferred or durable handle teardown,\nwhere no request work is available. Both the base-file unlink and the ADS\nxattr removal consequently run with the ksmbd worker credentials and can\nbypass filesystem permission checks.\n\nRun both operations with the credentials captured in struct file when the\nhandle was opened. This preserves the authenticated user's fsuid, fsgid,\nsupplementary groups and capability restrictions at final close."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c","fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"f08b3f451f12eee4abd8a5981803bc36db84458b","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"18c59109bb6fb816d5102171666f87cf1e29901d","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"e72c15085b6d86f45d224d98aa75b5cace4aaab9","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"4b7059974549d278e30fe70e2a4e421f9839817d","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"52e2f21911158ec961cd5aae19c56460db382af0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c","fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64393","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.663","lastModified":"2026-07-27T05:16:46.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: run set info with opener credentials\n\nSMB2 SET_INFO handlers call path-based VFS helpers after checking the\naccess mask granted to the SMB handle. Those helpers perform their owner,\ninode permission and LSM checks using the current ksmbd worker credentials.\n\nRun the complete SET_INFO dispatch with the credentials captured when the\nhandle was opened. This also removes the separate security information\ncredential setup and keeps all SET_INFO classes under one credential scope.\n\nDirect override_creds() is used because it can nest with the request\ncredential overrides already used by rename and link helpers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"5cbabf3a71575cd31bc7785d92d4ab42338a654b","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"b35afd5cf8fab236ef21117e42ee45691d4ffa7b","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"0ce682867fd506f61f40c76bde7e4205bde34e87","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"20ee516a62989a8d505ee432f9e59525ea23984e","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"8cc9ec711f5255167247a9ab6a7179b787426ed7","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"b383bcad3d2fe634b26efbce53e22bbb5753a520","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64394","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.790","lastModified":"2026-07-27T05:16:46.327","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY\n\ncommit cc57232cae23 (\"ksmbd: fix FSCTL permission bypass by adding a\npermission check for FSCTL_SET_SPARSE\") added a fp->daccess gate to\nfsctl_set_sparse and noted that \"similar handle-level checks exist in other\nfunctions but are missing here.\" The SMB2 SET_INFO SECURITY arm is one of\nthe missing ones, and the most security-relevant: smb2_set_info_sec() calls\nset_info_sec() with no per-handle access check.\n\nset_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it\nrewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via\nset_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and\nrewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().\nEvery other persistent-mutation arm of the sibling handler\nsmb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA /\nFILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm —\nwhich mutates the access control itself — is the only one with no gate.\n\nA client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no\nFILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType\nSMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself\naccess the handle's daccess never carried. Unlike the FSCTL data arms this\nis a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop —\nthe missing fp->daccess check is the entire gate.\n\nSetting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so\nrequire at least one of those on the handle before re-permissioning the\nfile. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"0848b1d8b403f530878195dcbe241a2fddb9d0e1","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"e6aa731f1b4b3e08caebf66a99f04b22bdab2e99","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"9ab2ffd3ed3d4ca1667c52de27026ddabc11e537","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"f56535db508ead8dec1c481ad93d7d8acd8f8f1e","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"aae600cdaffc6d9ce97645f129799a103a97d06d","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"44df157a1183a7f746caa970c169255da5ac61f8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0848b1d8b403f530878195dcbe241a2fddb9d0e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44df157a1183a7f746caa970c169255da5ac61f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ab2ffd3ed3d4ca1667c52de27026ddabc11e537","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aae600cdaffc6d9ce97645f129799a103a97d06d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6aa731f1b4b3e08caebf66a99f04b22bdab2e99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f56535db508ead8dec1c481ad93d7d8acd8f8f1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64395","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:22.923","lastModified":"2026-07-27T05:16:46.473","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require source read access for duplicate extents\n\nFSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to\nvfs_clone_file_range() or vfs_copy_file_range() without checking the SMB\naccess mask granted to the source handle. A handle opened with attribute\naccess can consequently be used to copy file contents into an\nattacker-readable destination.\n\nRequire FILE_READ_DATA on the source handle before either VFS operation,\nmatching other ksmbd data-copy paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"2d2ab6983620c2d60ce7db72133984ca3873b929","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"67bdad9cf01b25030e3bf00bbce6c309319d6663","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"db231af842868268839f9f9619c68cb27830d8be","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"a10942af27832c2761d020863a46e79bebe0567d","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"cedff600f1642aa982178503552f0d007bc829c8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64396","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.040","lastModified":"2026-07-27T05:16:46.603","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation\n\nWhen a blocking byte-range lock request is deferred in the\nFILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into\nthe connection's async_requests list via setup_async_work(). The cancel\ncallback smb2_remove_blocked_lock() holds a reference to the flock.\n\nIf the lock waiter is subsequently woken up but the work state is no\nlonger KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the\ncleanup path calls locks_free_lock(flock) without dequeuing the work from\nthe async_requests list. Concurrently, smb2_cancel() walks the list\nunder conn->request_lock and invokes the cancel callback, which then\ndereferences the already freed 'flock'. This leads to a slab-use-after-free\ninside __wake_up_common.\n\nFix this by restructuring the cleanup logic after the worker returns\nfrom ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist) and\nrelease_async_work(work) to the top of the cleanup block. This guarantees\nthat the async work is completely dequeued and serialized under\nconn->request_lock before locks_free_lock(flock) is called, rendering\nthe flock unreachable for any concurrent smb2_cancel()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"367c42a611fe488b7b03f1f6737f4dee0e8b20a2","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"7703fd9aba1f2483c8e55f9ff73b7663e0761ed9","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"463bbd79698513af4dad50fe1c573825f297ca2e","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"5aa1cb01155f96824003baf7997cdf1f150caba3","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"5c75275c0fc9a2deb0d8f5604edcb16f288171c8","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64397","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.160","lastModified":"2026-07-27T05:16:46.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: serialize QUERY_DIRECTORY requests per file\n\nsmb2_query_dir() stores a pointer to its stack-allocated private data in\nthe ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the\nsame file handle can overwrite this pointer while an iterate_dir() callback\nis still using it, resulting in a stack use-after-free.\n\nAdd a per-file mutex and hold it while accessing the shared directory\nenumeration state. The lock covers scan restart, dot entry state,\nreaddir_data setup and iteration, and response construction. This prevents\nanother request from replacing readdir_data.private before the current\nrequest has finished using it and also serializes the shared file position."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"1426fd79102539bc0ab5c8fced047ad4313b9908","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"2a64dbf9c739ddf7a25a066507597bf89f8f73d2","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"64dac2d486ec1eb18dc00968b16a230b6b75ec24","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"fd22b039a5a05bc1d6818e9dcd1001fb432a829d","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"be6d26bf27499977c746abc163659915082348d8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64398","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.280","lastModified":"2026-07-27T05:16:46.877","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n\nFSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via\nksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after\nchecking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no\nper-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES\nstill yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of\nFILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it\nO_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only\nthe missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with\nKASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle\nzeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to\n(6/6; a FILE_READ_DATA-only handle was correctly denied).\n\nThis is the unfixed sibling of commit cc57232cae23 (\"ksmbd: fix FSCTL\npermission bypass by adding a permission check for FSCTL_SET_SPARSE\").\nBecause SET_ZERO_DATA writes data (not an attribute), require\nFILE_WRITE_DATA."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"25377f369688dd0bd814dc8965ed26d44238ecaa","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"3072d82461f498c85daea8766e9d8bfbada31605","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"ca53bb17f4e8232cfaece3953d3cef62c559b039","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"deffa929086d7902e30918adf3dd27ccfe9c08b1","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"3320ba068198adc144c89d6661b805acce01735b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64399","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.397","lastModified":"2026-07-27T05:16:47.010","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE\n\nThe FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the\ndestination file's data via vfs_clone_file_range() with neither the\nshare-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle\nfp->daccess check that the other write-bearing arms carry. A client can\noverwrite destination data on a read-only share, or from a handle opened\nwith only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).\nFILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via\nthe clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;\nrequire FILE_WRITE_DATA since this writes data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"bf460ad5958d506492de4524a656439da3f99c51","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"620d133d469295ee7c017ca6aafac335f65c4a5a","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"baae7b39673ec21073a25e3d14f8feaada01d5df","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"c917e4522d251071dde9871b9142d8ea1186ebfe","versionType":"git","status":"affected"},{"version":"eb817368f50c1cbe1bd07044124aad7db6330e3a","lessThan":"388e4139db27a9e3612c9d356b826f5b1ff6a9e3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64400","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.510","lastModified":"2026-07-27T05:16:47.173","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root. When a crafted path attempts to\nescape the share boundary using parent-directory components ('..'),\nvfs_path_parent_lookup() detects this and immediately fails,\nreturning -EXDEV.\n\nHowever, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.\nThe function fails to intercept the -EXDEV error and erroneously\nfalls through to the caseless retry logic, which is intended only\nfor genuinely missing files. During this retry process, the path\nis reconstructed, leading to an unintended LOOKUP_BENEATH bypass\nthat allows write-capable users to create zero-length files or\ndirectories outside the exported share.\n\nFix this by ensuring that the execution only proceeds to the caseless\nlookup retry when the error is specifically -ENOENT. Any other errors,\nsuch as -EXDEV from a path traversal attempt, must be returned immediately."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"74d7970febf7e9005375aeda0df821d2edffc9f7","lessThan":"8c9a4f1327eb71efbf14842e7b8a6d965077eb67","versionType":"git","status":"affected"},{"version":"74d7970febf7e9005375aeda0df821d2edffc9f7","lessThan":"54bab9ba5a9f156ffa9324fcbe5a356fd0242f95","versionType":"git","status":"affected"},{"version":"019aae488dbc67c97a33db03652e20e2c9e3afa7","versionType":"git","status":"affected"},{"version":"6927ffe7479c72e7ebf885507227266a75f7c97d","versionType":"git","status":"affected"},{"version":"ef6cc1c465786b3e4e735d1ab8b616b3e94402df","versionType":"git","status":"affected"},{"version":"5.15.145","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.71","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.3.10","lessThan":"6.4","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.7}]},"references":[{"url":"https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64401","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.610","lastModified":"2026-07-27T05:16:47.303","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: resolve SWN tcon from live registrations\n\ncifs_swn_notify() looks up a witness registration by id under\ncifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's\ncached tcon pointer.  That pointer is not a lifetime reference, and it is\nnot a stable representative once cifs_get_swn_reg() lets multiple tcons\nfor the same net/share name share one registration id.\n\nA same-share second mount can keep the cifs_swn_reg alive after the first\ntcon unregisters and is freed.  The registration then still points at the\nfreed first tcon, so taking tc_lock or incrementing tc_count through\nswnreg->tcon only moves the use-after-free earlier.  Taking tc_lock while\nholding cifs_swnreg_idr_mutex also violates the documented CIFS lock\norder.\n\nFix this by making the registration store only the stable witness\nidentity: id, net name, share name, and notify flags.  When a notify\narrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,\nthen find and pin a live witness tcon that currently matches the net/share\npair under the normal cifs_tcp_ses_lock -> tc_lock order.  The notification\npath uses that pinned tcon directly and drops the reference when done.\n\nRegistration and unregister messages now use the live tcon passed by the\ncaller instead of a cached tcon in the registration.  The final unregister\nsend is folded into cifs_swn_unregister() while the registration is still\nprotected by cifs_swnreg_idr_mutex.  This removes the previous\nfind/drop/reacquire raw-pointer window.  The release path only removes the\nidr entry and frees the stable identity strings.\n\nThis preserves the intended one-registration/many-tcon behavior: a\nregistration id represents a net/share pair, and notify handling acts on a\nlive representative selected at use time.  It also preserves CLIENT_MOVE\nordering for the representative tcon because the old-IP unregister is sent\nbefore cifs_swn_register() sends the new-IP register."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifs_swn.c","fs/smb/client/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fed979a7e082bd9f25f9002c3c4f8740dacd0bc8","lessThan":"51d18db392e5386a7bb9e816d611f14e600cca3c","versionType":"git","status":"affected"},{"version":"fed979a7e082bd9f25f9002c3c4f8740dacd0bc8","lessThan":"aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd","versionType":"git","status":"affected"},{"version":"fed979a7e082bd9f25f9002c3c4f8740dacd0bc8","lessThan":"945b4a4a54497db1dcb2f20ef801a84e884dac21","versionType":"git","status":"affected"},{"version":"fed979a7e082bd9f25f9002c3c4f8740dacd0bc8","lessThan":"91b8a58c6ac15c7db6518f696389933282f88da7","versionType":"git","status":"affected"},{"version":"fed979a7e082bd9f25f9002c3c4f8740dacd0bc8","lessThan":"0700f946659d0ab2352ec8a9b1c6fc74b13a27d7","versionType":"git","status":"affected"},{"version":"fed979a7e082bd9f25f9002c3c4f8740dacd0bc8","lessThan":"ec457f9afe5ae9538bdcd58fd4cb442b9787e183","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifs_swn.c","fs/smb/client/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0700f946659d0ab2352ec8a9b1c6fc74b13a27d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51d18db392e5386a7bb9e816d611f14e600cca3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91b8a58c6ac15c7db6518f696389933282f88da7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/945b4a4a54497db1dcb2f20ef801a84e884dac21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec457f9afe5ae9538bdcd58fd4cb442b9787e183","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64402","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.737","lastModified":"2026-07-27T05:16:47.443","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()\n\nWhen the SMB sink is used as a perf AUX sink, smb_update_buffer() calls\nsmb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring\nbuffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is\nhandle->head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages\nnormalization is only applied after the first loop iteration.\n\nThis leaves the initial page index underived from the buffer size, which\ncan result in an out-of-bounds write past dst_pages[] when head exceeds\nthe AUX buffer size.\n\nNormalize head modulo the AUX buffer size before deriving the page index\nand offset, mirroring tmc_etr_sync_perf_buffer()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwtracing/coresight/ultrasoc-smb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"06f5c2926aaa0fba7f99678da6ef77cbbbda1441","lessThan":"38dbc8db8341ccdf8e1e1a067453d33ad751864b","versionType":"git","status":"affected"},{"version":"06f5c2926aaa0fba7f99678da6ef77cbbbda1441","lessThan":"4c5a0a946373da99a80398289b28845b5ae40cd1","versionType":"git","status":"affected"},{"version":"06f5c2926aaa0fba7f99678da6ef77cbbbda1441","lessThan":"661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb","versionType":"git","status":"affected"},{"version":"06f5c2926aaa0fba7f99678da6ef77cbbbda1441","lessThan":"daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f","versionType":"git","status":"affected"},{"version":"06f5c2926aaa0fba7f99678da6ef77cbbbda1441","lessThan":"98495b5a4d77dd22e106f462b76e1093a55b29a7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwtracing/coresight/ultrasoc-smb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/38dbc8db8341ccdf8e1e1a067453d33ad751864b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c5a0a946373da99a80398289b28845b5ae40cd1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98495b5a4d77dd22e106f462b76e1093a55b29a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64403","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:23.850","lastModified":"2026-07-27T05:16:47.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate option length before reading conf opt value\n\nl2cap_get_conf_opt() derives the option length from the\nattacker-controlled opt->len field and immediately dereferences\nopt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a\nraw pointer for the default case) before any caller has confirmed\nthat opt->len bytes are present in the buffer. The callers\n(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and\nl2cap_conf_rfc_get()) only detect a malformed option afterwards, once\nthe running length has gone negative, by which point the\nout-of-bounds read has already executed.\n\nAn existing post-hoc length check keeps the garbage value from being\nconsumed, so this is not a data leak in the current control flow. It\nis still a validate-after-use ordering bug: up to 4 bytes are read\npast the end of the buffer before it is known to contain them, and it\nis fragile to future changes in the callers.\n\nFix it at the source. Pass the end of the buffer into\nl2cap_get_conf_opt() and refuse to touch opt->val unless the full\noption (header + value) fits. Each caller computes an end pointer\nonce before the loop and checks the return value directly instead of\ninferring the error from a negative length."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"cca81b4bc672604a84f6d224a55cc77ec7dee619","versionType":"git","status":"affected"},{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"f70d4aa88068096f35d73e3a05eff33c0a16b9cd","versionType":"git","status":"affected"},{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"7d871e969b941ce25653f7716203a0ea4d07ad4b","versionType":"git","status":"affected"},{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"98d93c226bdfaa79bbdd86981921d7f106374225","versionType":"git","status":"affected"},{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"996d3da39899aceb8f4910911a3f19a45a7d9d1b","versionType":"git","status":"affected"},{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"73abbaf91aa33da87c008fb62c148ade561bb606","versionType":"git","status":"affected"},{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"6b47bdaacfd0045687880177e0987055d8f4765a","versionType":"git","status":"affected"},{"version":"7c9cbd0b5e38a1672fcd137894ace3b042dfbf69","lessThan":"687617555cedfb74c9e3cb85d759b908dcb17856","versionType":"git","status":"affected"},{"version":"78c2887130f1a7d1883195732be1b6cdab667487","versionType":"git","status":"affected"},{"version":"ac7c597c465eb09391e40febbe088bdad601080b","versionType":"git","status":"affected"},{"version":"ade4560e4fea198866e033fe1c02f063d6d7db2e","versionType":"git","status":"affected"},{"version":"99665dcf6ff803351b5e658f3a929cb498561e36","versionType":"git","status":"affected"},{"version":"2b59d36f22622c92c0b06aee7571f0a86a217188","versionType":"git","status":"affected"},{"version":"15d6538a0d6e0f6de5116081a948cba7cc3e1d3d","versionType":"git","status":"affected"},{"version":"a556547bae00528f24b42786b41a14047db14b84","versionType":"git","status":"affected"},{"version":"3.16.66","lessThan":"3.17","versionType":"semver","status":"affected"},{"version":"3.18.138","lessThan":"3.19","versionType":"semver","status":"affected"},{"version":"4.4.178","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.167","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.110","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.33","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.0.6","lessThan":"5.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f70d4aa88068096f35d73e3a05eff33c0a16b9cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64406","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:24.243","lastModified":"2026-07-27T05:16:47.730","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/af_bluetooth.c","net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"751de6ec671fe75ad9cf65a0638d2a06b6a5984d","lessThan":"c0577c55219be42b6ea2ea8db11e85bfab6f4e8d","versionType":"git","status":"affected"},{"version":"407217734835d21d4e0105ebf347860dc1806f88","lessThan":"96ad400d5132eb333f28f6f1e2d58f0728ca9547","versionType":"git","status":"affected"},{"version":"7eebd4c2c86f573af87ff165d08a83432eb0b919","lessThan":"0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0","versionType":"git","status":"affected"},{"version":"5d86d2f1b4d9a508c441d3e45277ae1a73cfed57","lessThan":"c66a95e60b65d876a927123b0ed36bd6177d9ca6","versionType":"git","status":"affected"},{"version":"87c543e2f78d0871f271df92dab98901bbd5b6f5","lessThan":"6303ed4bbe0095f4cc195225479bf506e010d1db","versionType":"git","status":"affected"},{"version":"added1213395071470a900cc845a042fb51882a6","lessThan":"26168db1ce5a9766cde021b18e590a101c056614","versionType":"git","status":"affected"},{"version":"ab1513597c6cf17cd1ad2a21e3b045421b48e022","lessThan":"50c662bdcd51b03033a0abed6716bfd377ba1049","versionType":"git","status":"affected"},{"version":"ab1513597c6cf17cd1ad2a21e3b045421b48e022","lessThan":"4bd0b274054f2679f28b70222b607bb0afc3ab9a","versionType":"git","status":"affected"},{"version":"a5ca86a6097a8b030ca3226cd300b17ed330f966","versionType":"git","status":"affected"},{"version":"5.10.259","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.15.210","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.175","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.142","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.92","lessThan":"6.12.96","versionType":"semver","status":"affected"},{"version":"6.18.34","lessThan":"6.18.39","versionType":"semver","status":"affected"},{"version":"7.0.11","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/af_bluetooth.c","net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64408","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:24.517","lastModified":"2026-07-27T05:16:47.873","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: pin L2CAP connection during netdev registration\n\nbnep_add_connection() reads the L2CAP connection without holding the\nchannel lock, then passes its HCI device to register_netdev(). Controller\nteardown can clear and release that connection concurrently, leaving the\nnetwork device registration path to dereference a freed parent device.\n\nTake a reference to the L2CAP connection while holding the channel lock.\nRetain it until register_netdev() has taken the parent device reference."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/bnep/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"390b5db3ff8745187f094c4e915663b7b1f98944","versionType":"git","status":"affected"},{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"46a88784c4c9b96954dd86f747ce93f65efa1302","versionType":"git","status":"affected"},{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"551ae773ec64045b4e72099132654887e0270bcc","versionType":"git","status":"affected"},{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"ae215c5b6422d8eda443b861b124bd1be6969c31","versionType":"git","status":"affected"},{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"df22adc7eafc22e651561813c11dc51a796b12ee","versionType":"git","status":"affected"},{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"a6b22dbd80926556290ad2243be25218d6956a19","versionType":"git","status":"affected"},{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"563a8573047182f550b1e1e030615755cd8c41da","versionType":"git","status":"affected"},{"version":"65f53e9802dbfae0e5758a91793c3f5f8bece49b","lessThan":"bb067a99a0356196c0b89a95721985485ebce5a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/bnep/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64410","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:24.753","lastModified":"2026-07-27T05:16:48.003","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: IPIP tunnel hardware offload is not yet support\n\nNo driver supports for IPIP tunnels yet, give up early on setting up the\nhardware offload for this scenario.\n\nThis patch adds a stub that can be enhanced to add more configuration\nthat are currently not supported. As of now, the offload work is\nenqueued to the worker, then ignored if the hardware offload\nconfiguration is not supported.\n\nCheck the NF_FLOW_HW flag to know if this entry was already tried once\nto be offloaded so this is not retried on refresh when unsupported. Move\nNF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag\nis unset the _del and _stats variants are never called.\n\nThis can be updated later on to skip hardware offload work to be queued\nin case hardware offload does not support it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/netfilter/nf_flow_table.h","net/netfilter/nf_flow_table_core.c","net/netfilter/nf_flow_table_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"9efe838c13133acb70c78d04c49e8362fe533566","versionType":"git","status":"affected"},{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"6c5dcab95f4cd42a1648739ec9300fbb4b1a021f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/netfilter/nf_flow_table.h","net/netfilter/nf_flow_table_core.c","net/netfilter/nf_flow_table_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6c5dcab95f4cd42a1648739ec9300fbb4b1a021f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9efe838c13133acb70c78d04c49e8362fe533566","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64411","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:24.853","lastModified":"2026-07-27T05:16:48.123","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: terminate table name before find_table_lock()\n\nupdate_counters() and compat_update_counters() forward a user-supplied\n32-byte table name to find_table_lock() without NUL-terminating it. On a\nlookup miss, find_inlist_lock() calls try_then_request_module(..., \"%s%s\",\n\"ebtable_\", name), and vsnprintf() reads past the name field and the\nstack object until it hits a zero byte.\n\n  BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n  Read of size 1 at addr ffff8880119dfb20 by task exploit/147\n  Call Trace:\n  ...\n   string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n   vsnprintf (lib/vsprintf.c:2945)\n   __request_module (kernel/module/kmod.c:150)\n   do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)\n   update_counters (net/bridge/netfilter/ebtables.c:1440)\n   do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)\n   nf_setsockopt (net/netfilter/nf_sockopt.c:101)\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1424)\n   raw_setsockopt (net/ipv4/raw.c:847)\n   __sys_setsockopt (net/socket.c:2393)\n  ...\n\ncompat_do_replace() shares the same unterminated name via\ncompat_copy_ebt_replace_from_user(); terminate it there too so all\nfind_table_lock() callers behave alike. The other callers already\nterminate the name after the copy."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/netfilter/ebtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4c046ca4e35a83ea32f6e748f54139f5fe2a1d01","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ab63ccefb9c71627f957a0724c2b9ebc869c6f20","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c6f539311e58e76aa96feef0f1572b13a564f8a2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2664f537ca5bcb2ef3fac2683dcca602e51fad24","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7436da6c1bc44654b7f11a17e746f6999fd37250","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b6183b1b88a722b6d8ea0cecc99eba168a15e0be","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a622d2e9608c9dff47fc2e5759ac7aa3a836b45d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/netfilter/ebtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64412","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:24.990","lastModified":"2026-07-27T05:16:48.263","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: module names must be null-terminated\n\nWe need to explicitly check the length, else we may pass non-null\nterminated string to request_module()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/netfilter/ebtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"43dd2332b8a27b3ac5108791680cade654ab0f96","versionType":"git","status":"affected"},{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"5777c8f1c3610786d8482b8f620f40fccaf1542b","versionType":"git","status":"affected"},{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"0ddca0f90fa3395111d078ae4399615cf3ea94aa","versionType":"git","status":"affected"},{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"d2367d99f2455f373996d9ddbe833dbe9f942213","versionType":"git","status":"affected"},{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"da32e78bbb187ed7b137e0007034185570a3a172","versionType":"git","status":"affected"},{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"13a5f532e3a4fc75c33060a026def1572c208643","versionType":"git","status":"affected"},{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8","versionType":"git","status":"affected"},{"version":"bcf4934288402be3464110109a4dae3bd6fb3e93","lessThan":"084d23f818321390509e9738a0b08bbf46df6425","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/netfilter/ebtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/084d23f818321390509e9738a0b08bbf46df6425","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0ddca0f90fa3395111d078ae4399615cf3ea94aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/13a5f532e3a4fc75c33060a026def1572c208643","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/43dd2332b8a27b3ac5108791680cade654ab0f96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5777c8f1c3610786d8482b8f620f40fccaf1542b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2367d99f2455f373996d9ddbe833dbe9f942213","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da32e78bbb187ed7b137e0007034185570a3a172","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64413","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:25.110","lastModified":"2026-07-27T05:16:48.390","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo->chainstack[1].\n\nNot a real-world bug, such allocation isn't expected to fail\nin the first place."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/netfilter/ebtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2ade612967e2cdfb9290ebcb773f302c82f311fa","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"42bef500d07b5769d916e9122a3e3fa3fd2245ef","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fc7f105451044501a50cfd530cfa3b472c54acbc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9e6c5169db423e51dcc66a73fd15409c0d38e088","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"29bf41a9b59aff9f6197df58641a00037d567ca8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9f74d28e903fa4fdf82f870d0aeadddc8196e41c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5ee856e4208acafaaaf7b84824d39b78c21345d6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cbfe53599eebffd188938ab6774cc41794f6f9d5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/netfilter/ebtables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64414","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:25.237","lastModified":"2026-07-27T05:16:48.540","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: handle unreadable frags\n\nsashiko reports:\n When an skb with unreadable fragments (such as from devmem TCP, where\n skb_frags_readable(skb) returns false) is processed by the u32 module,\n skb_copy_bits() will safely return a negative error code [..]\n\nxt_u32: bail out with hotdrop in this case.\ngather_frags: return -1, just as if we had no fragment header.\nnfnetlink_queue: restrict to the linear part.\nnfnetlink_log: restrict to the linear part.\n\nv2:\n - skb_zerocopy helpers don't copy readable flag, i.e. nfnetlink_queue\n is broken too\n xt_u32 shouldn't return true if hotdrop was set."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/netfilter/nf_conntrack_reasm.c","net/netfilter/nfnetlink_log.c","net/netfilter/nfnetlink_queue.c","net/netfilter/xt_u32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","lessThan":"3b13e7635795394705920cca1e1db7e4ca2e334b","versionType":"git","status":"affected"},{"version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","lessThan":"fc5bfe63bacf8a3ae307b62b34206406ca733354","versionType":"git","status":"affected"},{"version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","lessThan":"57056be3ec12e7d9ecd20a60d4060f510e4f284c","versionType":"git","status":"affected"},{"version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","lessThan":"da5b58478a9c1b85608c9e40a3b8432d071b409e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/netfilter/nf_conntrack_reasm.c","net/netfilter/nfnetlink_log.c","net/netfilter/nfnetlink_queue.c","net/netfilter/xt_u32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/3b13e7635795394705920cca1e1db7e4ca2e334b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57056be3ec12e7d9ecd20a60d4060f510e4f284c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da5b58478a9c1b85608c9e40a3b8432d071b409e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc5bfe63bacf8a3ae307b62b34206406ca733354","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64418","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:25.727","lastModified":"2026-07-27T05:16:48.697","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished ->css_online() yet.\n\nOnce pn->shrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--> list_add_tail_rcu(&css->sibling, &parent_css->children);\n    online_css\n    --> mem_cgroup_css_online\n        --> alloc_shrinker_info\n            --> alloc node0 info\n                rcu_assign_pointer(C->node0->shrinker_info, old0)\n                alloc node1 info -> FAIL -> goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --> shrinker_memcg_alloc\n                           --> mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --> mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --> old0 = C->node0->shrinker_info\n                                       memcpy(new->unit, old0->unit, ...);\n\n                free_shrinker_info\n                --> kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -> free_shrinker_info() unwind path tears down the already\npublished pn->shrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/shrinker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"307bececcd1205bcb67a3c0d53a69db237ccc9d4","lessThan":"b9a280a9a454ed514636351d53fe2a233dc5054b","versionType":"git","status":"affected"},{"version":"307bececcd1205bcb67a3c0d53a69db237ccc9d4","lessThan":"6465ff3ce65131c774a312d450abe10f4b9f3875","versionType":"git","status":"affected"},{"version":"307bececcd1205bcb67a3c0d53a69db237ccc9d4","lessThan":"284c267f013e45d8c89d9fb9373105dc8e6c0947","versionType":"git","status":"affected"},{"version":"307bececcd1205bcb67a3c0d53a69db237ccc9d4","lessThan":"65476d31d8056e859c48580f82295ce159196ffe","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/shrinker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64420","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:25.963","lastModified":"2026-07-27T05:16:48.827","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\n\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\ncros_ec_dev structure. However, because the drvdata was already set,\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\nto access &typec->ec->ec->dev on a device that has already been released.\nMove dev_set_drvdata() to ensure that the pointer is only made available\nonce all initialization steps have succeeded.\n\n sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'\n Call trace:\n  sysfs_do_create_link_sd+0x94/0xdc\n  sysfs_create_link+0x30/0x44\n  device_add_class_symlinks+0x90/0x13c\n  device_add+0xf0/0x50c\n  ec_device_probe+0x150/0x4f0\n  platform_probe+0xa0/0xe0\n ...\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\n Pointer tag: [f5], memory tag: [fe]\n Tainted : [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  __memcpy+0x44/0x230\n  cros_ec_check_features+0x60/0xcc [cros_ec_proto]\n  cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\n  platform_probe+0xa0/0xe0"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mfd/cros_ec_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"24522713034d521ea4b5f5f36342e2b2f7e73bd6","versionType":"git","status":"affected"},{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"f7e81dc181d9fe8ab977158042cd193e8cc12091","versionType":"git","status":"affected"},{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"257203d83204b192d1265a916b42ca0d499bb117","versionType":"git","status":"affected"},{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"729ae27dc2503a7c1f92da1859efb45da03e4fa0","versionType":"git","status":"affected"},{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"ed2941e5db016a0c600b25f1972620e6e223d9fa","versionType":"git","status":"affected"},{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d","versionType":"git","status":"affected"},{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"fc030c5b116f668d4ca86dca63742ddbc98d1665","versionType":"git","status":"affected"},{"version":"1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b","lessThan":"8b2c1d41bc36c100b38ce5ee6def246c527eaf8a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mfd/cros_ec_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64422","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:26.213","lastModified":"2026-07-27T05:16:48.970","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: bound TCP reordering sysctl writes and MTU probe sizes\n\nReject invalid `net.ipv4.tcp_reordering` values before they reach TCP\nsocket state. The sysctl is stored as an `int` but copied into the\n`u32` `tp->reordering` field for new sockets, so negative writes wrap\nto large values.\n\nWith `tcp_mtu_probing=2`, the wrapped value can overflow the\n`tcp_mtu_probe()` size calculation and drive the MTU probing path into\nan out-of-bounds read. Route `tcp_reordering` writes through\n`proc_dointvec_minmax()` and require it to be at least 1. Also require\n`tcp_max_reordering` to be at least 1 so the configured maximum cannot\nbecome negative either.\n\nWhen registering the table for a non-init network namespace, relocate\n`extra2` pointers that refer into `init_net.ipv4` so the\n`tcp_reordering` upper bound follows that namespace's\n`tcp_max_reordering`.\n\nHarden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`.\nThis keeps the send queue and window checks from being bypassed through\nsigned integer overflow."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/sysctl_net_ipv4.c","net/ipv4/tcp_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"f0d88a4cd03affff6c08adf6c63964e235aede43","versionType":"git","status":"affected"},{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"27ddf4486c7dbf5bdd393fa8bef6b67179796d98","versionType":"git","status":"affected"},{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae","versionType":"git","status":"affected"},{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"e81f805824a8109504fce090641b17d135b48cd1","versionType":"git","status":"affected"},{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"99206ce2244f8a3ed64298d0667c9055845a5dc7","versionType":"git","status":"affected"},{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"bbae351c0f32f7c200249e4aa6561b2b419dcf69","versionType":"git","status":"affected"},{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"a094ac95d3b69adfa1676eb9c8eae6835d4f1671","versionType":"git","status":"affected"},{"version":"91cc17c0e5e5ada156a8d5787a2509d263ea6bbf","lessThan":"efb8763d7bbb40cff4cc55a6b62c3095a038149c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/sysctl_net_ipv4.c","net/ipv4/tcp_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","lessThan":"2.6.24","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64423","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:26.350","lastModified":"2026-07-27T05:16:49.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: remove multicast group from hash table on device destruction\n\nWhen a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through\nthe multicast list and calls ip_ma_put() on each membership, scheduling\nthem for RCU reclamation. However, they are not unlinked from the device's\nmulticast hash table (mc_hash).\n\nSince the device remains published in dev->ip_ptr until after\nip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash\ncan still locate and access the multicast group after its refcount is\ndecremented. If the RCU callback runs and frees the group while a reader is\naccessing it, a use-after-free occurs.\n\nFix this by unlinking the multicast group from mc_hash using\nip_mc_hash_remove() before scheduling it for reclamation.\n\nBUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0\nRead of size 4 at addr ffff888009bf1408 by task mausezahn/2276\n\nCall Trace:\n <IRQ>\n dump_stack_lvl+0x67/0x90\n print_report+0x175/0x7c0\n kasan_report+0x147/0x180\n ip_check_mc_rcu+0x149/0x3f0\n udp_v4_early_demux+0x36d/0x12d0\n ip_rcv_finish_core+0xb8b/0x1390\n ip_rcv_finish+0x54/0x120\n NF_HOOK+0x213/0x2b0\n __netif_receive_skb+0x126/0x340\n process_backlog+0x4f2/0xf00\n __napi_poll+0x92/0x2c0\n net_rx_action+0x583/0xc60\n handle_softirqs+0x236/0x7f0\n do_softirq+0x57/0x80\n </IRQ>\n\nAllocated by task 2239:\n kasan_save_track+0x3e/0x80\n __kasan_kmalloc+0x72/0x90\n ____ip_mc_inc_group+0x31a/0xa40\n __ip_mc_join_group+0x334/0x3f0\n do_ip_setsockopt+0x16fa/0x2010\n ip_setsockopt+0x3f/0x90\n do_sock_setsockopt+0x1ad/0x300\n\nFreed by task 0:\n kasan_save_track+0x3e/0x80\n kasan_save_free_info+0x40/0x50\n __kasan_slab_free+0x3a/0x60\n __rcu_free_sheaf_prepare+0xd4/0x220\n rcu_free_sheaf+0x36/0x190\n rcu_core+0x8d9/0x12f0\n handle_softirqs+0x236/0x7f0"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/igmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"412ba7def06ffe974ba9a1d862b022362c54ffa5","versionType":"git","status":"affected"},{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"c6cb5f8ebe1c1a78710c19f102db9fe48b9e6ba9","versionType":"git","status":"affected"},{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"5f42729d74bd6c61306d864423290d92962de4e1","versionType":"git","status":"affected"},{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"76d030ac95e17f91d69a595f17ebc5979700cf9a","versionType":"git","status":"affected"},{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"8820b530cb2388503d7418228d03ba074bf7a03e","versionType":"git","status":"affected"},{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"2ca18df1c2611f70eb3eb487e02ae85eb703b284","versionType":"git","status":"affected"},{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"f91883031e5a62877a29ce139442973cbea769f1","versionType":"git","status":"affected"},{"version":"e9897071350bd9d94a56b5b6f79c85b1a98fc7e7","lessThan":"7993211bde166471dffac074dc965489f86531f8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/igmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.11","status":"affected"},{"version":"0","lessThan":"3.11","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2ca18df1c2611f70eb3eb487e02ae85eb703b284","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/412ba7def06ffe974ba9a1d862b022362c54ffa5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f42729d74bd6c61306d864423290d92962de4e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76d030ac95e17f91d69a595f17ebc5979700cf9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7993211bde166471dffac074dc965489f86531f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8820b530cb2388503d7418228d03ba074bf7a03e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6cb5f8ebe1c1a78710c19f102db9fe48b9e6ba9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f91883031e5a62877a29ce139442973cbea769f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64430","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:27.203","lastModified":"2026-07-27T05:16:49.260","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: epf: Avoid calling pci_irq_vector() from hardirq context\n\nntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to derive\nthe vector number. pci_irq_vector() calls msi_get_virq() that takes a\nmutex and can therefore trigger \"scheduling while atomic\" splats:\n\n  BUG: scheduling while atomic: kworker/u33:0/55/0x00010001\n  ...\n  Call trace:\n   ...\n   schedule+0x38/0x110\n   schedule_preempt_disabled+0x28/0x50\n   __mutex_lock.constprop.0+0x848/0x908\n   __mutex_lock_slowpath+0x18/0x30\n   mutex_lock+0x4c/0x60\n   msi_domain_get_virq+0xe8/0x138\n   pci_irq_vector+0x2c/0x60\n   ntb_epf_vec_isr+0x28/0x120 [ntb_hw_epf]\n   __handle_irq_event_percpu+0x70/0x3a8\n   handle_irq_event+0x48/0x100\n   handle_edge_irq+0x100/0x1c8\n   ...\n\nCache the Linux IRQ number for vector 0 when vectors are allocated and\nuse it as a base in the ISR. Running the ISR in a threaded IRQ handler\nwould also avoid the problem, but that would be unnecessary here."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/ntb/hw/epf/ntb_hw_epf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"812ce2f8d14ea791edd88c36ebcc9017bf4c88cb","lessThan":"33bba331a4a5fee8b6026fe72eca13cceeec1b7b","versionType":"git","status":"affected"},{"version":"812ce2f8d14ea791edd88c36ebcc9017bf4c88cb","lessThan":"aff271b12a1eb8c8b3da19223ae1a6abe1e8168b","versionType":"git","status":"affected"},{"version":"812ce2f8d14ea791edd88c36ebcc9017bf4c88cb","lessThan":"1dba8444ac0100133d72374634f6d7451fff1ccc","versionType":"git","status":"affected"},{"version":"812ce2f8d14ea791edd88c36ebcc9017bf4c88cb","lessThan":"174a97f21bf9c54fa37ec0f321692e862ea130a3","versionType":"git","status":"affected"},{"version":"812ce2f8d14ea791edd88c36ebcc9017bf4c88cb","lessThan":"f71e8d9875069fa73e335f63f02ec6e52e3aaa51","versionType":"git","status":"affected"},{"version":"812ce2f8d14ea791edd88c36ebcc9017bf4c88cb","lessThan":"6350df503897d57c5634f71b0767d48c3b837583","versionType":"git","status":"affected"},{"version":"812ce2f8d14ea791edd88c36ebcc9017bf4c88cb","lessThan":"4dcddc1c794d1c65eda68f1f8dd04a0fecc0870f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/ntb/hw/epf/ntb_hw_epf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/174a97f21bf9c54fa37ec0f321692e862ea130a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1dba8444ac0100133d72374634f6d7451fff1ccc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33bba331a4a5fee8b6026fe72eca13cceeec1b7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dcddc1c794d1c65eda68f1f8dd04a0fecc0870f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6350df503897d57c5634f71b0767d48c3b837583","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aff271b12a1eb8c8b3da19223ae1a6abe1e8168b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f71e8d9875069fa73e335f63f02ec6e52e3aaa51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64431","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:27.327","lastModified":"2026-07-27T05:16:49.397","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid calling post_write_mst_fixup() for invalid index_block\n\nntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write()\nreturns an error, intending to restore the buffer after a failed write.\n\nHowever, ntfs_ib_write() returns an error immediately if\npre_write_mst_fixup() validation fails. The caller,\nntfs_icx_ib_sync_write(), interprets any error as a write failure\nrequiring rollback. It does not differentiate between I/O errors and\nvalidation failures, and calls post_write_mst_fixup() anyway.\n\nSince post_write_mst_fixup() assumes that the index_block contents is\ncorrect, it doesn't perform the boundary checks, which results in\nout-of-bounds memory access.\n\nAn attacker can craft a malicious NTFS image with:\n  - large index_block.usa_ofs offset, pointing outside the ntfs_record\n  - index_block.usa_count = 0, causing integer underflow\n  - or index_block.usa_count larger than actual number of sectors in the\n    ntfs_record, causing out-of-bounds access\n\nKASAN reports describing the memory corruption:\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x19c/0x1d0\n  Read of size 2 at addr ffff8881586c9018 by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x19c/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x19c/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x19c/0x1d0\n   post_write_mst_fixup+0x19c/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in post_write_mst_fixup+0x1aa/0x1d0\n  Write of size 2 at addr ffff8881586c91fe by task p/9428\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x100/0x190\n   print_report+0x139/0x4ad\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   ? __virt_addr_valid+0x262/0x500\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   kasan_report+0xe4/0x1d0\n   ? post_write_mst_fixup+0x1aa/0x1d0\n   post_write_mst_fixup+0x1aa/0x1d0\n   ntfs_icx_ib_sync_write+0x179/0x220\n   ntfs_inode_sync_filename+0x83d/0x1080\n   __ntfs_write_inode+0x1049/0x1480\n   ntfs_file_fsync+0x131/0x9b0\n  ==================================================================\n\nLet's move the post_write_mst_fixup() call to ntfs_ib_write().\nThe ntfs_ib_write() function calls pre_write_mst_fixup() at the beginning.\nIf the index_block contents is invalid, pre_write_mst_fixup() fails and\nntfs_ib_write() returns early without calling post_write_mst_fixup() on\nbad index_block."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0","lessThan":"e2018628301a6d9f54e34b0cb417f1688c66df1d","versionType":"git","status":"affected"},{"version":"0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0","lessThan":"5b6eedd7cc2936f9238e852b553a1b326105bde8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/5b6eedd7cc2936f9238e852b553a1b326105bde8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2018628301a6d9f54e34b0cb417f1688c66df1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64432","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:27.437","lastModified":"2026-07-27T05:16:49.527","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns\n\nIn the analysis pass of $LogFile journal replay, log_replay() copies\nLCNs from each action log record into an existing Dirty Page Table\n(DPT) entry without bounding the destination index. A crafted NTFS\nimage with DPT entry lcns_follow=1 and an action log record with\nlcns_follow=2 produces a kernel slab out-of-bounds write at mount\ntime:\n\n  BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60\n  Write of size 8 at addr ffff8880095e1040 by task mount\n\nTwo attacker-controlled fields can drive j+i past the allocated\npage_lcns[] array:\n\n  1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow.\n  2. lrh->target_vcn may be smaller than dp->vcn, making the u64\n     subtraction wrap to a huge size_t.\n\nValidate target VCN delta and per-record LCN count against the\nDPT entry capacity, bail via the existing out: cleanup label with\n-EINVAL.\n\nThis mirrors the bounds-check pattern added in commit b2bc7c44ed17\n(\"fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot\")\nand commit 0ca0485e4b2e (\"fs/ntfs3: validate rec->used in\njournal-replay file record check\")."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"964c3fae1dfc49dde5468eace940f199cda234e9","versionType":"git","status":"affected"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"3aa96956ca2200674e2a8f9c23ec6ecd45e5010f","versionType":"git","status":"affected"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"946046841013ebac8492ef49651c53638d7a9a6a","versionType":"git","status":"affected"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"c6f9e804f73ef809529865fbc7256dd189ff8c33","versionType":"git","status":"affected"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"cf28fc1658463d768657cf1c27a83980d4ba7ef2","versionType":"git","status":"affected"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"f433acc85b86f327d03ba8b03a33c105c51053de","versionType":"git","status":"affected"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"57382ec6ac63b63dce2789e835fded28b698ae79","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64434","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:27.717","lastModified":"2026-07-27T05:16:49.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n\nl2cap_chan_timeout() runs asynchronously and accesses chan->conn. If\nthe connection is torn down while the timer is running or pending,\nchan->conn can be freed, leading to a use-after-free when the timer\nworker attempts to lock conn->lock:\n\n| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83\n|\n| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n| Workqueue: events l2cap_chan_timeout\n| Call Trace:\n|  <TASK>\n|  instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n|  atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n|  __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n|  mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n|  l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422\n|  process_one_work kernel/workqueue.c:3326 [inline]\n|  process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n|  worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n|  kthread+0x346/0x430 kernel/kthread.c:436\n|  ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n|  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|  </TASK>\n|\n| Allocated by task 320:\n|  l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075\n|  l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452\n|  hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]\n|  hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760\n|  hci_event_func net/bluetooth/hci_event.c:7796 [inline]\n|  hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847\n|  hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040\n|  process_one_work kernel/workqueue.c:3326 [inline]\n|  process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n|  worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n|  kthread+0x346/0x430 kernel/kthread.c:436\n|  ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n|  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|\n| Freed by task 322:\n|  hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]\n|  hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736\n|  hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405\n|  hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]\n|  hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679\n|  vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690\n|  __fput+0x369/0x890 fs/file_table.c:510\n|  task_work_run+0x160/0x1d0 kernel/task_work.c:233\n|  get_signal+0xf5b/0x1120 kernel/signal.c:2810\n|  arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337\n|  __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]\n|  exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98\n|  do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100\n|  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n|\n| The buggy address belongs to the object at ffff8881298d9400\n|  which belongs to the cache kmalloc-512 of size 512\n| The buggy address is located 336 bytes inside of\n|  freed 512-byte region [ffff8881298d9400, ffff8881298d9600)\n\nFix it by having chan->conn hold a reference to l2cap_conn (via\nl2cap_conn_get) when the channel is added to the connection, and\nreleasing it in the channel destructor. This ensures the l2cap_conn\nremains alive as long as the channel exists.\n\nA new FLAG_DEL channel flag is introduced to indicate that the ch\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"89dec92041717b027216e110599e4f6d6c921b79","lessThan":"91047a4396a8b1857a6f712a90cf33ec0012b189","versionType":"git","status":"affected"},{"version":"50dfec218808b148ab4247b1858031b7a32015c5","lessThan":"0b0e2bf39cf99e458d991b9df253727e036a7d7d","versionType":"git","status":"affected"},{"version":"859d3ace791ed878ae9ba5522c7844d960da8f88","lessThan":"d3b739db5dc6f688a60d56da872fabaf65246032","versionType":"git","status":"affected"},{"version":"8c8e620467a7b51562dbcefbd1f09f288d7d710d","lessThan":"50c38d9f42a529691e4e67ea9cedf4f0bfc8d277","versionType":"git","status":"affected"},{"version":"8c8e620467a7b51562dbcefbd1f09f288d7d710d","lessThan":"b66774b48dd98f07254951f74ea6f513efe7ff8b","versionType":"git","status":"affected"},{"version":"3634cbdc2eb414b69ffa752ddbe5e0458518e321","versionType":"git","status":"affected"},{"version":"e1c100e2d61bd8c718b7d91fe3e050780a9bf72d","versionType":"git","status":"affected"},{"version":"deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9","versionType":"git","status":"affected"},{"version":"7555fd885a0603f50e49a655850a1f2bd8a25398","versionType":"git","status":"affected"},{"version":"6.6.143","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.93","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.18.35","lessThan":"6.18.39","versionType":"semver","status":"affected"},{"version":"5.10.259","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.210","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.176","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"7.0.12","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64435","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:27.873","lastModified":"2026-07-27T05:16:49.843","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: Fix data races of skb_queue_len() readers on audit_queue\n\nMultiple readers access audit_queue.qlen via skb_queue_len() without\nholding the queue lock or using READ_ONCE(), while kauditd writes to\nthis field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE()\nprotected by a spinlock. This constitutes data races.\n\nAll affected skb_queue_len(&audit_queue) call sites:\n  - kauditd_thread() wait_event_freezable() condition\n  - audit_receive_msg() AUDIT_GET handler (s.backlog assignment)\n  - audit_receive() backlog check\n  - audit_log_start() backlog check and pr_warn()\n\nKCSAN reports the following conflicting access pattern (one example):\n==================================================================\nBUG: KCSAN: data-race in audit_log_start / skb_dequeue\n\nwrite (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57:\n skb_dequeue+0x70/0xf0\n kauditd_send_queue+0x71/0x220\n kauditd_thread+0x1cb/0x430\n kthread+0x1c2/0x210\n ret_from_fork+0x162/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nread to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1:\n audit_log_start+0x2a0/0x6b0\n audit_core_dumps+0x64/0xa0\n do_coredump+0x14b/0x1260\n get_signal+0xeb2/0xf70\n arch_do_signal_or_restart+0x41/0x170\n exit_to_user_mode_loop+0xa2/0x1c0\n do_syscall_64+0x1a3/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0xe0\n\nvalue changed: 0x00000001 -> 0x00000000\n==================================================================\n\nResolve the race by switching to lockless helper skb_queue_len_lockless(),\nwhich internally uses READ_ONCE() and properly pairs with the WRITE_ONCE()\nwrite accesses already present on the writer side.\n\n[PM: line length tweak]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/audit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0","versionType":"git","status":"affected"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"b35597bdae1a5d8395da4b9baa993b9b71f74d68","versionType":"git","status":"affected"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"e575dabb805252e3113fdc3f56f6ecacfde422d0","versionType":"git","status":"affected"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"7ff42312ccde549f8c698723822c7db35107a39b","versionType":"git","status":"affected"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"a3d85dec60bb0622360fc176b2a51abdbe2ff0ad","versionType":"git","status":"affected"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"fe997a84a385f840b593ead92e575503a5046cee","versionType":"git","status":"affected"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"c5186201fa7030289cc4fe23fae87a3fcb566856","versionType":"git","status":"affected"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","lessThan":"c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/audit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ff42312ccde549f8c698723822c7db35107a39b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3d85dec60bb0622360fc176b2a51abdbe2ff0ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b35597bdae1a5d8395da4b9baa993b9b71f74d68","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5186201fa7030289cc4fe23fae87a3fcb566856","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e575dabb805252e3113fdc3f56f6ecacfde422d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe997a84a385f840b593ead92e575503a5046cee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64436","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.010","lastModified":"2026-07-27T05:16:50.033","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_key: initialize alg_key_len for IPComp states\n\npfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by\nallocating x->calg and copying only the algorithm name:\n\n\tx->calg = kmalloc_obj(*x->calg);\n\tif (!x->calg) {\n\t\terr = -ENOMEM;\n\t\tgoto out;\n\t}\n\tstrcpy(x->calg->alg_name, a->name);\n\tx->props.calgo = sa->sadb_sa_encrypt;\n\nUnlike the authentication (x->aalg) and encryption (x->ealg) branches of\nthe same function, the compression branch never initializes\ncalg->alg_key_len.  IPComp carries no key and the allocation only\nreserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field\nis left containing uninitialized slab data.\n\ncalg->alg_key_len is later used as a length by xfrm_algo_clone() when an\nIPComp state is cloned during XFRM_MSG_MIGRATE:\n\n\txfrm_state_migrate()\n\t  xfrm_state_clone_and_setup()\n\t    x->calg = xfrm_algo_clone(orig->calg);\n\t      kmemdup(orig, xfrm_alg_len(orig));\n\nwhere xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8.  With\na non-zero garbage alg_key_len, kmemdup() reads past the end of the\n68-byte calg object.  Adding an IPComp SA via PF_KEY and then migrating\nit triggers (net-next, KASAN, init_on_alloc=0):\n\n  BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60\n  Read of size 4164 at addr ff11000025a74980 by task diag2/9287\n  CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x10e/0x1f0\n   print_report+0xf7/0x600\n   kasan_report+0xe4/0x120\n   kasan_check_range+0x105/0x1b0\n   __asan_memcpy+0x23/0x60\n   kmemdup_noprof+0x44/0x60\n   xfrm_state_migrate+0x70a/0x1da0\n   xfrm_migrate+0x753/0x18a0\n   xfrm_do_migrate+0xb47/0xf10\n   xfrm_user_rcv_msg+0x411/0xb50\n   netlink_rcv_skb+0x158/0x420\n   xfrm_netlink_rcv+0x71/0x90\n   netlink_unicast+0x584/0x850\n   netlink_sendmsg+0x8b0/0xdc0\n   ____sys_sendmsg+0x9f7/0xb90\n   ___sys_sendmsg+0x134/0x1d0\n   __sys_sendmsg+0x16d/0x220\n   do_syscall_64+0x116/0x7d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   </TASK>\n\n  Allocated by task 9287:\n   kasan_save_stack+0x33/0x60\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0xaa/0xb0\n   pfkey_add+0x2652/0x2ea0\n   pfkey_process+0x6d0/0x830\n   pfkey_sendmsg+0x42c/0x850\n   __sys_sendto+0x461/0x4b0\n   __x64_sys_sendto+0xe0/0x1c0\n   do_syscall_64+0x116/0x7d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  The buggy address belongs to the object at ff11000025a74980\n   which belongs to the cache kmalloc-96 of size 96\n  The buggy address is located 0 bytes inside of\n   allocated 68-byte region [ff11000025a74980, ff11000025a749c4)\n\nDepending on the uninitialized value the same field can instead request\nan oversized kmemdup() allocation and make the migration clone fail.\n\nThe XFRM netlink path is not affected: verify_one_alg() rejects an\nXFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via\nXFRM_MSG_NEWSA is always self-consistent.\n\nInitialize calg->alg_key_len to 0, matching the aalg/ealg branches."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"58e82fc3dedb57b1432292504415b224fd2d6acb","versionType":"git","status":"affected"},{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"01b9115b55018123ef2449ac4951f89147a8428e","versionType":"git","status":"affected"},{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"3f63d1752d90c0e28be931a48ab5d89bc97d637d","versionType":"git","status":"affected"},{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"273c06b81d2e902b21acc801ae18c8276c8a9b69","versionType":"git","status":"affected"},{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"6de2a650917bedaaefd65b17cede83c5e2c1dedd","versionType":"git","status":"affected"},{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"e8417353cbd078d10531ba3928e609c84ab09e6b","versionType":"git","status":"affected"},{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e","versionType":"git","status":"affected"},{"version":"80c9abaabf4283f7cf4a0b3597cd302506635b7f","lessThan":"d129c3177d7b1138fd5066fcc63a698b3ba415b0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.21","status":"affected"},{"version":"0","lessThan":"2.6.21","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/01b9115b55018123ef2449ac4951f89147a8428e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/273c06b81d2e902b21acc801ae18c8276c8a9b69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f63d1752d90c0e28be931a48ab5d89bc97d637d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/58e82fc3dedb57b1432292504415b224fd2d6acb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6de2a650917bedaaefd65b17cede83c5e2c1dedd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d129c3177d7b1138fd5066fcc63a698b3ba415b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8417353cbd078d10531ba3928e609c84ab09e6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64437","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.160","lastModified":"2026-07-27T05:16:50.213","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL\n\nCommit f580d27e8928 (\"ksmbd: fix use-after-free of a deferred file_lock on\ndouble SMB2_CANCEL\") made smb2_cancel() skip a work whose state is\nKSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But\nKSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same\nfreeing producer path is reached for CLOSED too:\n\n  SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets\n  the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()\n  worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s\n  the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes\n  the STATUS_RANGE_NOT_LOCKED branch with \"goto out2\" -- which, like the\n  cancelled branch, skips release_async_work(). The work stays on\n  conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock\n  pointing at the freed file_lock.\n\nA subsequent SMB2_CANCEL for the same AsyncId then passes the\nKSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so\nsmb2_cancel() fires cancel_fn again over the freed file_lock -- the same\nuse-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:\n\n  BUG: KASAN: slab-use-after-free in __locks_delete_block\n    __locks_delete_block\n    locks_delete_block\n    ksmbd_vfs_posix_lock_unblock\n    smb2_remove_blocked_lock\n    smb2_cancel                 <- 2nd SMB2_CANCEL fires cancel_fn\n    handle_ksmbd_work\n  Allocated by ...: locks_alloc_lock <- smb2_lock\n  Freed by ...:     locks_free_lock  <- smb2_lock (non-ACTIVE early-exit)\n  ... cache file_lock_cache of size 192\n\nReproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with\nKASAN by an authenticated SMB client; the double-SMB2_CANCEL control is\nsilent on that kernel, so the splat is attributable to the CLOSE trigger.\n\nOnly an ACTIVE deferred work may have its cancel_fn fired: both terminal\nstates (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees\nthe file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE\nso any non-active work is skipped."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b7063c7426ea5a4d15e01b60538718765392f49d","lessThan":"a796ba4e61d5e14e07b79a359faac69f8f9b22a3","versionType":"git","status":"affected"},{"version":"0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd","lessThan":"b8e274e69ab09222c7a552c7c0c1eef9ce627fc1","versionType":"git","status":"affected"},{"version":"89ae9df09d2c1fb4a4eb495c113a7ce1dca34147","lessThan":"ddb9239828336b36d8a3ef5943fdffb2f55b6508","versionType":"git","status":"affected"},{"version":"14d2eee0193ac3cd1bf3d014373449f0b8d35d6d","lessThan":"94083db751930b1540ddff2b54d4677549c57f81","versionType":"git","status":"affected"},{"version":"f580d27e8928828693df44ba2db0fffdbe11dfea","lessThan":"12c36c99655f325befe50c26842f7deca414c381","versionType":"git","status":"affected"},{"version":"f580d27e8928828693df44ba2db0fffdbe11dfea","lessThan":"10f293a07f9e10e988b0ae44e2e99c631f5a68e0","versionType":"git","status":"affected"},{"version":"2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694","versionType":"git","status":"affected"},{"version":"6.1.176","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.143","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.94","lessThan":"6.12.96","versionType":"semver","status":"affected"},{"version":"6.18.36","lessThan":"6.18.39","versionType":"semver","status":"affected"},{"version":"7.0.13","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/10f293a07f9e10e988b0ae44e2e99c631f5a68e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/12c36c99655f325befe50c26842f7deca414c381","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94083db751930b1540ddff2b54d4677549c57f81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a796ba4e61d5e14e07b79a359faac69f8f9b22a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8e274e69ab09222c7a552c7c0c1eef9ce627fc1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddb9239828336b36d8a3ef5943fdffb2f55b6508","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64438","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.303","lastModified":"2026-07-27T05:16:50.363","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n  Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n  Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n  Call Trace:\n    kasan_report+0x119/0x140\n    mutex_lock+0x76/0xe0\n    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n    adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n    process_one_work+0x6ac/0xfd0\n    worker_thread+0x4dd/0xd30\n    kthread+0x326/0x410\n    ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h","drivers/crypto/intel/qat/qat_common/adf_common_drv.h","drivers/crypto/intel/qat/qat_common/adf_isr.c","drivers/crypto/intel/qat/qat_common/adf_sriov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"218c2836b3987f3fa1d9eac505462cded0821e4c","versionType":"git","status":"affected"},{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"446b4d77599cf1a168573f7fb32a4a6aa4f09219","versionType":"git","status":"affected"},{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"5d916c1eae1933511a69bffe243b4ee5d7da399c","versionType":"git","status":"affected"},{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"f344a369d0380d54c8d6c8d24734a78dd5a89817","versionType":"git","status":"affected"},{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"51144032248cc4ea22917370565650670b8b4e9b","versionType":"git","status":"affected"},{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"49cd5ac6de8de39a14ead609bb552d372d5602cd","versionType":"git","status":"affected"},{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"6e92b28cd74fa433658efeadf21b9d4b01023d7d","versionType":"git","status":"affected"},{"version":"ed8ccaef52fa03fb03cff45b380f72c9f869f273","lessThan":"277281c10c63791067d24d421f7c43a15faa9096","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h","drivers/crypto/intel/qat/qat_common/adf_common_drv.h","drivers/crypto/intel/qat/qat_common/adf_isr.c","drivers/crypto/intel/qat/qat_common/adf_sriov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64439","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.447","lastModified":"2026-07-27T05:16:50.527","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5 - filter out async aead implementations at alloc\n\nkrb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and\nrfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL\ncompletion callback and treat any negative return from\ncrypto_aead_{encrypt,decrypt}() as terminal, falling through to\nkfree_sensitive(buffer).  When the encrypt_name resolves to an\nasync AEAD instance the request returns -EINPROGRESS, the buffer\nis freed while the backend's worker still holds a pointer, and the\nworker dereferences the freed slab on completion.\n\nKASAN report under UML+SLUB with a synthetic async aead backend\nbound to krb5->encrypt_name:\n\n  BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7\n\nThe helpers were written synchronously, so filter the async\ninstances out at allocation time instead of plumbing\ncrypto_wait_req() through every call site.\n\nReachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and\nnet/ceph/crypto.c on systems with an async AEAD provider bound to\nthe krb5 enctype name."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["crypto/krb5/krb5_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"00244da40f7821b242c4612428d4192230dba27f","lessThan":"ef6feb77e2d91761427c5b773edc9c97e1b706ad","versionType":"git","status":"affected"},{"version":"00244da40f7821b242c4612428d4192230dba27f","lessThan":"2b7bd6dccff14b8b632c5244f1fd506918077221","versionType":"git","status":"affected"},{"version":"00244da40f7821b242c4612428d4192230dba27f","lessThan":"6c9dddeb582fde005360f4fe02c760d45ca05fb5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["crypto/krb5/krb5_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2b7bd6dccff14b8b632c5244f1fd506918077221","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c9dddeb582fde005360f4fe02c760d45ca05fb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef6feb77e2d91761427c5b773edc9c97e1b706ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64440","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.547","lastModified":"2026-07-27T05:16:50.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB write in HT_caps_handler()\n\nHT_caps_handler() iterates pIE->length bytes and writes into\nHT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct\nHT_caps_element). Because pIE->length is a raw u8 from an over-the-air\n802.11 AssocResponse frame and is never validated, a malicious AP can\nset it up to 255, causing up to 229 bytes of out-of-bounds writes into\nadjacent fields of struct mlme_ext_info.\n\nTruncate the iteration count to the size of HT_caps.u.HT_cap using\numin() so that data from a longer-than-expected IE is silently ignored\nrather than written out of bounds, preserving interoperability with APs\nthat pad the element. An early return on oversized IEs was considered\nbut rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1\nassignment that precedes the loop, silently disabling HT mode for APs\nthat append extra bytes to the HT Capabilities IE."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"37f642d47c3648a707df3ceb092eee1adffbfd28","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"8c872b47c7fc32e95e0da1db7512388794adcd69","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"918537a0fbed85aab61fa28ad75e6279070610c9","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"6f91621fc45025ad3c0be796b70e6e4cee22fc69","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"f8001e1a516ba3b495728c65b61f799cbfad6bd0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37f642d47c3648a707df3ceb092eee1adffbfd28","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f91621fc45025ad3c0be796b70e6e4cee22fc69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c872b47c7fc32e95e0da1db7512388794adcd69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/918537a0fbed85aab61fa28ad75e6279070610c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8001e1a516ba3b495728c65b61f799cbfad6bd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64441","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.670","lastModified":"2026-07-27T05:16:50.777","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()\n\nThree IE/attribute parsing functions have missing bounds checks.\n\nrtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer\nwithout verifying that the header bytes (tag + length) are within the\nremaining buffer before reading them.  Additionally, rtw_get_sec_ie()\ncompares the 4-byte WPA OUI at cnt+2 without checking that at least\n6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at\ncnt+6 without checking that at least 10 bytes remain.\n\nrtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at\nentry, before verifying that wps_ielen is large enough to contain\nthe 6-byte WPS IE header (element_id + length + 4-byte OUI).  Inside\nthe attribute loop, get_unaligned_be16() is called on attr_ptr and\nattr_ptr+2 without checking that 4 bytes remain in the buffer.\n\nAdd a cnt+2 bounds check before each loop body in rtw_get_sec_ie()\nand rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum\nIE length requirement, add a wps_ielen < 6 early return in\nrtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"efa27d487abcdec79669a60a6d94d5d6eceb7c1d","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"2ea1ce30ead61589214240e8d33d96310fd613e5","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"b27ecba3196f6c14e3809595ebd69c0c2392512a","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"4b51ee8a40fe47864197d73cc02b191de7a6b072","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"729c4e72563bda0f1725db1db9ea08df06f41d9b","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ea1ce30ead61589214240e8d33d96310fd613e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b51ee8a40fe47864197d73cc02b191de7a6b072","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/729c4e72563bda0f1725db1db9ea08df06f41d9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b27ecba3196f6c14e3809595ebd69c0c2392512a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/efa27d487abcdec79669a60a6d94d5d6eceb7c1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64442","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.793","lastModified":"2026-07-27T05:16:50.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()\n\nTwo IE parsing loops are missing the header bounds checks before they\ndereference pIE->length:\n\n - issue_assocreq() walks pmlmeinfo->network.ies to build the\n   association request. If the stored IE data ends with only an\n   element_id byte and no length byte, pIE->length is read one byte\n   past the end of the buffer.\n\n - join_cmd_hdl() walks pnetwork->ies during station join and has\n   the same problem under the same conditions.\n\nBoth buffers are filled from AP beacon and probe-response frames, so a\nmalicious AP that sends a truncated final IE can trigger the issue.\n\nApply the two-guard pattern established in update_beacon_info():\n  1. Break if fewer than sizeof(*pIE) bytes remain.\n  2. Break if the IE's declared data extends past the buffer end."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"bc881c9915c4468747d0ca5fd1abd7b313cfb0f4","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"605ebd94d0f469204f3c9f2f84acc71e43e2780f","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"a830bdc82461353bf7b1f8a2ad2689bf5d2de444","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"4c21eec80cf502d9ea18e0b946246b2376452786","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"c38d16b1ffac385c9e4b38447cd5c46af1114b58","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"402f13ec95945f34a210b28df1f8740d3d4a58c5","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"ef61d628dfad38fead1fd2e08979ae9126d011d5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef61d628dfad38fead1fd2e08979ae9126d011d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64443","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:28.930","lastModified":"2026-07-27T05:16:51.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\n\nThe IE parsing loop in update_beacon_info() advances by\n(pIE->length + 2) each iteration but only guards on i < len.\nWhen a malicious AP sends a Beacon whose last IE has only one byte\nremaining in the frame (the element_id byte lands at len-1), the loop\nreads pIE->length from one byte past the allocated receive buffer.\n\nAdditionally, even when the header bytes are in bounds, pIE->length\nitself can extend the data window beyond len, passing a truncated IE\nto the handler functions.\n\nAdd two guards at the top of the loop body:\n  1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).\n  2. Break if the IE's declared data extends past len.\n\nAlso replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length\nfor consistency with the sizeof(*pIE) guards added above."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"6dd5e8c3011ebabf417257d7f07901a7c4311539","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"9193c34f75fd9e1ea8a590d7cced464c3380dc29","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"bd953d52d587d42365e399b96c52dbdb13032070","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"69f174a0673b6b7a29b851adb60bc450cdc0ecc4","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"b5cc2f999927f69723ca53f1f2a3aa37dbeda907","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"ed51de4a86e173c3b0ef78e039c2e49e08b11f16","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64444","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:29.053","lastModified":"2026-07-27T05:16:51.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop\n\nThe IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each\niteration but only guards on i < pkt_len. When a malicious AP sends an\nAssocResponse whose last IE has only one byte remaining in the frame\n(the element_id byte lands at pkt_len-1), the loop reads pIE->length\nfrom pframe[pkt_len], which is one byte past the allocated receive buffer.\n\nAdditionally, even when the header bytes are in bounds, pIE->length\nitself can extend the data window beyond pkt_len, silently passing a\ntruncated IE to the handler functions.\n\nAdd two guards at the top of the loop body:\n  1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).\n  2. Break if the IE's declared data extends past pkt_len."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"889ca6000ac7fa73457b041848fcb08e0d51b809","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"1a52a05471494546f955a58e8c170c0c796c52d5","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"0406d746574e875d8778552eb674fcfbf5330bfb","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"0970dd47726a57e52013594e9fbf667586eb3673","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"04f612dc03427e0b1ac80a2611b5ac0ba93ac446","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"7e7741c8315e4160aead00a60cdd6f81ab880717","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"f9654207e92283e0acac5d64fe5f8835383b5a23","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0406d746574e875d8778552eb674fcfbf5330bfb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/04f612dc03427e0b1ac80a2611b5ac0ba93ac446","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0970dd47726a57e52013594e9fbf667586eb3673","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a52a05471494546f955a58e8c170c0c796c52d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e7741c8315e4160aead00a60cdd6f81ab880717","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/889ca6000ac7fa73457b041848fcb08e0d51b809","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9654207e92283e0acac5d64fe5f8835383b5a23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64445","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:29.177","lastModified":"2026-07-27T05:16:51.337","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()\n\nOnAuth() has two bugs in the shared-key authentication path.\n\nWhen the Privacy bit is set, rtw_wep_decrypt() is called without\nverifying that the frame is long enough to contain a valid WEP IV and\nICV.  Inside rtw_wep_decrypt(), length is computed as:\n\n    length = len - WLAN_HDR_A3_LEN - iv_len\n\nand then passed as (length - 4) to crc32_le().  If len is less than\nWLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative\nand, after the implicit cast to size_t, causes crc32_le() to read far\nbeyond the frame buffer.  Add a minimum length check before accessing\nthe IV field and calling the decryption path.\n\nWhen processing a seq=3 response, rtw_get_ie() stores the Challenge\nText IE length in ie_len, but the subsequent memcmp() always reads 128\nbytes regardless of ie_len.  IEEE 802.11 mandates a challenge text of\nexactly 128 bytes; reject any IE whose length field differs, matching\nthe check already applied to OnAuthClient()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"665e1ecb68b4e8419604e70a33f02d1c8b0222c6","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"c9000c93078e5c0a5a651b077c0ec92a4bc7d580","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"1f6c9d255bdda41216b6e34c96aa2b1abee0bb84","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"3e44a7665f3abd320a80d9c64ee4a93317041b8b","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"64ec4192d9c10e96922245d4a6747304cc76b19d","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"d90b9f39f375c9826ef145605dfe97765d0ecb91","versionType":"git","status":"affected"},{"version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","lessThan":"a1fc19d61f661d47204f095b593de507884849f7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1f6c9d255bdda41216b6e34c96aa2b1abee0bb84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3e44a7665f3abd320a80d9c64ee4a93317041b8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64ec4192d9c10e96922245d4a6747304cc76b19d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/665e1ecb68b4e8419604e70a33f02d1c8b0222c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1fc19d61f661d47204f095b593de507884849f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9000c93078e5c0a5a651b077c0ec92a4bc7d580","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d90b9f39f375c9826ef145605dfe97765d0ecb91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64447","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:29.437","lastModified":"2026-07-27T05:16:51.487","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: ipu7: fix double-free and use-after-free in error paths\n\nIn both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and\nthen passed to ipu7_bus_initialize_device(), which stores it in\nadev->pdata. The ipu7_bus_release() function frees adev->pdata when the\ndevice's reference count drops to zero.\n\nTwo error paths incorrectly call kfree(pdata) after the device teardown\nhas already freed it:\n\n1. When ipu7_mmu_init() fails: put_device() is called, which drops the\n   reference count to zero and triggers ipu7_bus_release() ->\n   kfree(pdata). The subsequent kfree(pdata) is a double-free.\n\n2. When ipu7_bus_add_device() fails: it calls auxiliary_device_uninit()\n   internally, which calls put_device() -> ipu7_bus_release() ->\n   kfree(pdata). The subsequent kfree(pdata) is again a double-free.\n\nNote that the kfree(pdata) when ipu7_bus_initialize_device() itself\nfails is correct, because in that case auxiliary_device_init() failed\nand the release function was never set up, so pdata must be freed\nmanually.\n\nAdditionally, the error code was not saved before calling put_device(),\ncausing ERR_CAST() to dereference the already-freed adev pointer when\nconstructing the return value. Fix this by saving the error from\ndev_err_probe() before put_device() and returning ERR_PTR() instead.\n\nRemove the redundant kfree(pdata) calls and fix the use-after-free in\nthe return values of the two affected error paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/media/ipu7/ipu7.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5","lessThan":"b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3","versionType":"git","status":"affected"},{"version":"b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5","lessThan":"837c1f9655421055f751ed34745e820a54a27642","versionType":"git","status":"affected"},{"version":"b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5","lessThan":"d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/media/ipu7/ipu7.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/837c1f9655421055f751ed34745e820a54a27642","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64448","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:29.557","lastModified":"2026-07-27T05:16:51.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: restrict implied bcc[0] exemption to responses without data area\n\nsmb2_check_message() has a long-standing quirk that accepts a response\nwhose calculated length is one byte larger than the bytes actually\nreceived (\"server can return one byte more due to implied bcc[0]\").\nThis was introduced to accommodate servers that omit the trailing bcc[0]\noverlap byte when no data area is present.\n\nHowever, the exemption is applied unconditionally, regardless of whether\nthe command actually carries a data area (has_smb2_data_area[]).  When a\nresponse with a data area is subject to the +1 exemption, the reported\ndata can extend one byte beyond the bytes actually received, yet\nsmb2_check_message() still accepts it.  The subsequent decoder then reads\npast the end of the receive buffer.  This is reachable during NEGOTIATE\nand SESSION_SETUP, before the session is established.\n\nThe resulting out-of-bounds reads are visible under KASAN when mounting\nagainst a non-conforming server; both the SPNEGO/negTokenInit and the\nNTLMSSP challenge decoders are affected:\n\n  BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00\n  Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81\n  CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x4e/0x70\n   print_report+0x157/0x4c9\n   kasan_report+0xce/0x100\n   asn1_ber_decoder+0x16a7/0x1b00\n   decode_negTokenInit+0x19/0x30\n   SMB2_negotiate+0x31d9/0x4c90\n   cifs_negotiate_protocol+0x1f2/0x3f0\n   cifs_get_smb_ses+0x93f/0x17e0\n   cifs_mount_get_session+0x7f/0x3a0\n   cifs_mount+0xb4/0xcf0\n   cifs_smb3_do_mount+0x23a/0x1500\n   smb3_get_tree+0x3b0/0x630\n   vfs_get_tree+0x82/0x2d0\n   fc_mount+0x10/0x1b0\n   path_mount+0x50d/0x1de0\n   __x64_sys_mount+0x20b/0x270\n   do_syscall_64+0xee/0x590\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   </TASK>\n  Allocated by task 85:\n   kmem_cache_alloc_noprof+0x106/0x380\n   mempool_alloc_noprof+0x116/0x1e0\n   cifs_small_buf_get+0x31/0x80\n   allocate_buffers+0x10d/0x2b0\n   cifs_demultiplex_thread+0x1d5/0x1d50\n   kthread+0x2c6/0x390\n   ret_from_fork+0x36e/0x5a0\n   ret_from_fork_asm+0x1a/0x30\n  The buggy address is located 0 bytes to the right of\n   allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)\n   which belongs to the cache cifs_small_rq of size 448\n\n  BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50\n  Read of size 329 at addr ffff88800726c678 by task mount.cifs/89\n  CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G    B      7.1.0-rc6 #1\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x4e/0x70\n   print_report+0x157/0x4c9\n   kasan_report+0xce/0x100\n   kasan_check_range+0x10f/0x1e0\n   __asan_memcpy+0x23/0x60\n   kmemdup_noprof+0x36/0x50\n   decode_ntlmssp_challenge+0x457/0x680\n   SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0\n   SMB2_sess_setup+0x219/0x4f0\n   cifs_setup_session+0x248/0xaf0\n   cifs_get_smb_ses+0xf79/0x17e0\n   cifs_mount_get_session+0x7f/0x3a0\n   cifs_mount+0xb4/0xcf0\n   cifs_smb3_do_mount+0x23a/0x1500\n   smb3_get_tree+0x3b0/0x630\n   vfs_get_tree+0x82/0x2d0\n   fc_mount+0x10/0x1b0\n   path_mount+0x50d/0x1de0\n   __x64_sys_mount+0x20b/0x270\n   do_syscall_64+0xee/0x590\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   </TASK>\n  Allocated by task 93:\n   kmem_cache_alloc_noprof+0x106/0x380\n   mempool_alloc_noprof+0x116/0x1e0\n   cifs_small_buf_get+0x31/0x80\n   allocate_buffers+0x10d/0x2b0\n   cifs_demultiplex_thread+0x1d5/0x1d50\n   kthread+0x2c6/0x390\n   ret_from_fork+0x36e/0x5a0\n   ret_from_fork_asm+0x1a/0x30\n  The buggy address is located 120 bytes inside of\n   allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)\n   which belongs to the cache cifs_small_rq of size 448\n\nRestrict the +1 exemption to responses that have no data area, so that\nit still covers the bcc[0] omission it was meant for.  When a data area\nis present, the +1 discrepancy instead means the reported data length\noverruns the\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"8d0bbc78046d264bbf6a574ea6f9072258a43e35","versionType":"git","status":"affected"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0","versionType":"git","status":"affected"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"31c6312608c60b72a1feb99a5afb680645a3e8a3","versionType":"git","status":"affected"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"573e502d14714d2947e22e7eff40ec20a6a44a42","versionType":"git","status":"affected"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"419ec1b604d7fb60c10aec2dc062371f9fcd4940","versionType":"git","status":"affected"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"ceb875a375dedbf51c9425c1d13a2d7a8435c08c","versionType":"git","status":"affected"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"6e9d10f62773b99bd927940fd9cbdfe7207e23ff","versionType":"git","status":"affected"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"53b7c271f06be4dd5cfc8c6ef552a8355c891a7f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64449","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:29.727","lastModified":"2026-07-27T05:16:51.783","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vme_user: bound slave read/write to the kern_buf size\n\nThe SLAVE-path helpers buffer_to_user() and buffer_from_user() copy\n'count' bytes into/out of the fixed-size kern_buf (size_buf ==\nPCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without\nbounding *ppos + count against size_buf.\n\nvme_user_write()/vme_user_read() only clamp count to the VME window size\n(image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the\nuser-supplied slave.size -- validated against the VME address space (up\nto VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE.  When the window\nexceeds 128 KiB, a write()/read() copies past the kern_buf allocation.\n\nClamp count against size_buf in both helpers, with an early return when\n*ppos is already at/after the buffer end.  *ppos is >= 0 here (the caller\nrejects negative offsets), so size_buf - *ppos cannot wrap.  This mirrors\nthe existing clamp in the MASTER-path helpers resource_to_user() /\nresource_from_user(), and matches the read()/write() convention of a\nshort transfer at end-of-buffer.\n\nFound by static analysis (CodeQL taint tracking + CBMC bounded model\nchecking) and confirmed dynamically under KASAN with the vme_fake bridge:\n\n  BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80\n  Write of size 262144 at addr ffff888004100000 by task trigger/68\n    _copy_from_user+0x2d/0x80\n    vme_user_write+0x13e/0x240 [vme_user]\n    vfs_write+0x1b8/0x7a0\n    ksys_write+0xb8/0x150"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/vme_user/vme_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","lessThan":"65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed","versionType":"git","status":"affected"},{"version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","lessThan":"adc8b9c30d716c362646edb45662aa1c641a154a","versionType":"git","status":"affected"},{"version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","lessThan":"8eff7cd4817e14dbe3b9952cce55ef52d1d38940","versionType":"git","status":"affected"},{"version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","lessThan":"e99f2df433c63c86c93de1e5f08f16e404388756","versionType":"git","status":"affected"},{"version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","lessThan":"1b495fa0d4927c88d88bf346bf311f2e26e860ed","versionType":"git","status":"affected"},{"version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","lessThan":"9f32f38265014fac7f5dc9490fb01a638ce6e121","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/vme_user/vme_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1b495fa0d4927c88d88bf346bf311f2e26e860ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8eff7cd4817e14dbe3b9952cce55ef52d1d38940","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f32f38265014fac7f5dc9490fb01a638ce6e121","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/adc8b9c30d716c362646edb45662aa1c641a154a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e99f2df433c63c86c93de1e5f08f16e404388756","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64450","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:29.850","lastModified":"2026-07-27T05:16:51.920","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix out-of-bounds read in broadcast Gap ACK blocks\n\nA broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its\ndata area. tipc_get_gap_ack_blks() only verifies that the record's len\nfield is self-consistent with its ugack_cnt/bgack_cnt counts\n(sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check\nthat the record actually fits in the message data area, msg_data_sz().\n\nThe unicast caller tipc_link_proto_rcv() bounds it (\"if (glen > dlen)\nbreak;\"), but the broadcast caller tipc_bcast_sync_rcv() discards the\nreturned size, so tipc_link_advance_transmq() copies the record off the\nreceive skb with an attacker-controlled count:\n\n\tthis_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt),\n\t\t\t  GFP_ATOMIC);\n\nA TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one\nordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its\ndata area is short, carrying a Gap ACK record with len = 0x400,\nbgack_cnt = 0xff and ugack_cnt = 0. len then equals\nstruct_size(p, gacks, 255), so the consistency check passes and ga is\nnon-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out\nof the much smaller skb:\n\n  BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60\n  Read of size 1024 at addr ffff0000c7030d38 by task poc864/69\n  Call trace:\n   kmemdup_noprof+0x48/0x60\n   tipc_link_advance_transmq+0x86c/0xb80\n   tipc_link_bc_ack_rcv+0x19c/0x1e0\n   tipc_bcast_sync_rcv+0x1c4/0x2c4\n   tipc_rcv+0x85c/0x1340\n   tipc_l2_rcv_msg+0xac/0x104\n  The buggy address belongs to the object at ffff0000c7030d00\n   which belongs to the cache skbuff_small_head of size 704\n  The buggy address is located 56 bytes inside of\n   allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)\n\nThe copied-out bytes are subsequently consumed as gap/ack values, but\nthe read is already out of bounds at the kmemdup() regardless of how\nthey are used.\n\nThe unicast STATE path drops such a message: \"if (glen > dlen) break;\"\nskips the rest of STATE_MSG handling and the skb is freed. Make the\nbroadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record\nagainst msg_data_sz() and, when it does not fit, reports it back through\ntipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than\nprocessed. ga is not cleared on this path: ga == NULL already means\n\"legacy peer without Selective ACK\", a distinct legitimate state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/tipc/bcast.c","net/tipc/bcast.h","net/tipc/node.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"055663d21dc4336f67933ab26bef3c5934be6324","versionType":"git","status":"affected"},{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"016f5995c37a5a2c45198308f830f244517d70b7","versionType":"git","status":"affected"},{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"74b45af86a767594ba52330cd440ea84e24d700d","versionType":"git","status":"affected"},{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"9a51115fcdc78687c8852bf93a1db3951dbb223b","versionType":"git","status":"affected"},{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"a21ed5064217cc33726da6c7ef1a520eba43aea1","versionType":"git","status":"affected"},{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"2de42e268174766cb2e2b90721afdfdff70e0d8d","versionType":"git","status":"affected"},{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"f333b6851bdf326fd2134133272dbbed0c94d921","versionType":"git","status":"affected"},{"version":"d7626b5acff9227e2a65da636a53e09bdafdc0aa","lessThan":"2b66974a1b6134a4bbc3bfed181f7418f688eb54","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/tipc/bcast.c","net/tipc/bcast.h","net/tipc/node.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/016f5995c37a5a2c45198308f830f244517d70b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/055663d21dc4336f67933ab26bef3c5934be6324","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b66974a1b6134a4bbc3bfed181f7418f688eb54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2de42e268174766cb2e2b90721afdfdff70e0d8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74b45af86a767594ba52330cd440ea84e24d700d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a51115fcdc78687c8852bf93a1db3951dbb223b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a21ed5064217cc33726da6c7ef1a520eba43aea1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f333b6851bdf326fd2134133272dbbed0c94d921","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64452","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:30.140","lastModified":"2026-07-27T05:16:52.080","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\n6lowpan: fix NHC entry use-after-free on error path\n\nlowpan_nhc_do_uncompression() looks up an NHC descriptor while holding\nlowpan_nhc_lock.  If the descriptor has no uncompress callback, the error\npath drops the lock before printing nhc->name.\n\nlowpan_nhc_del() removes descriptors under the same lock and then relies\non synchronize_net() before the owning module can be unloaded.  That only\nwaits for net RX RCU readers.  lowpan_header_decompress() is also exported\nand can be reached from callers that are not necessarily covered by the net\ncore RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive\npath.\n\nThis leaves a race where one task drops lowpan_nhc_lock in the error path,\nanother task unregisters and frees the matching descriptor after\nsynchronize_net() returns, and the first task then dereferences nhc->name\nfor the warning.\n\nWith the post-unlock window widened, KASAN reports:\n\n  BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220\n  Read of size 8\n  lowpan_nhc_do_uncompression\n  lowpan_header_decompress\n\nFix this by printing the warning before dropping lowpan_nhc_lock, so the\ndescriptor name is read while unregister is still excluded.  The malformed\npacket is still rejected with -ENOTSUPP."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/6lowpan/nhc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"9c2f5c0829a8c8b904dae36be6d8056b719ac605","versionType":"git","status":"affected"},{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"80b5c8779acee0550845394fb3e5176a398aa24c","versionType":"git","status":"affected"},{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"cc27aea4d454abfb385ee2c9499c78b96db9b728","versionType":"git","status":"affected"},{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"a8e3a94711134e898c6021a6b77374efa91b3639","versionType":"git","status":"affected"},{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168","versionType":"git","status":"affected"},{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"0beccbcf50de125be5520d0ffc59af4bb8655482","versionType":"git","status":"affected"},{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"b713aa0cc344f10f7a9928a230b5f5e780d04078","versionType":"git","status":"affected"},{"version":"92aa7c65d295f3cbb96904afe335f683e55584b8","lessThan":"1720db928e5a58ca7d75ac1d514c3b73fd7061a7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/6lowpan/nhc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64456","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:30.677","lastModified":"2026-07-27T05:16:52.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: virtio: clamp device-reported used.len at copy_data()\n\nrandom_recv_done() stores the device-reported used.len directly into\nvi->data_avail.  copy_data() then indexes vi->data[] using\nvi->data_idx (advanced by previous copy_data() calls) and issues a\nmemcpy() without re-validating either value against the posted\nbuffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32\nor 64).\n\nA malicious or buggy virtio-rng backend can set used.len beyond\nsizeof(vi->data), steering the memcpy() past the end of the inline\narray into adjacent kmalloc-1k slab bytes.  hwrng_fillfn() mixes\nthose bytes into the guest RNG, and guest root can also observe\nthem directly via /dev/hwrng.\n\nConcrete impact is inside the guest:\n\n - Memory-safety / hardening: any virtio-rng backend that\n   over-reports used.len causes the driver to read past vi->data\n   into unrelated slab contents.  hwrng_fillfn() is a kernel thread\n   that runs as soon as the device is probed; no guest userspace\n   interaction is required to first-trigger the OOB.\n\n - Cross-boundary leak (confidential-compute threat model): a\n   malicious hypervisor cooperating with a malicious or compromised\n   guest root userspace can use /dev/hwrng as a leak channel for\n   guest-kernel heap data.  The host sets a large used.len, guest\n   root reads /dev/hwrng, and the returned bytes contain guest\n   kernel slab contents that were adjacent to vi->data.  In\n   practice, confidential-compute guests (SEV-SNP, TDX) usually\n   disable virtio-rng entirely, so this path is narrow, but the\n   fix is still worth carrying because the underlying\n   memory-safety bug contaminates the guest RNG on any host.\n\nKASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend\nhas been patched to report used.len = 0x10000:\n\n  BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0\n  Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52\n  Call Trace:\n   __asan_memcpy+0x23/0x60\n   virtio_read+0x394/0x5d0\n   hwrng_fillfn+0xb2/0x470\n   kthread+0x2cc/0x3a0\n  Allocated by task 1:\n   probe_common+0xa5/0x660\n   virtio_dev_probe+0x549/0xbc0\n  The buggy address belongs to the object at ffff88800ae0b800\n   which belongs to the cache kmalloc-1k of size 1024\n  The buggy address is located 0 bytes to the right of\n   allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)\n\nSame class of bug as commit c04db81cd028 (\"net/9p: Fix buffer\noverflow in USB transport layer\"), which hardened\nusb9pfs_rx_complete() against unchecked device-reported length in\nthe USB 9p transport.\n\nWith the clamp at point of use and array_index_nospec() in place,\nthe same harness boots cleanly: copy_data() returns zero for the\nbogus report, the device-supplied bytes after data_idx are\ndiscarded, and the driver issues a fresh request."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5","versionType":"git","status":"affected"},{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"63335e7b638ae70028ae285bb95153874a8bc852","versionType":"git","status":"affected"},{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"2e788948ff2a13358a303af112497a63201c5739","versionType":"git","status":"affected"},{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"fde19b0d4eeabae042519313c843fe6f27d41e9d","versionType":"git","status":"affected"},{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"81dd21b5f0c299cc7b5bf84f04a61938559d20e6","versionType":"git","status":"affected"},{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"285e17c44e3873a73460f294acbd64018ff64385","versionType":"git","status":"affected"},{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"92d5736a62040ec1cfff23ea57e6599301690ad5","versionType":"git","status":"affected"},{"version":"f7f510ec195781c857ab76366a3e1c59e1caae42","lessThan":"e3046eeada299f917a8ad883af4434bfb86556b1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64459","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:31.073","lastModified":"2026-07-27T05:16:52.403","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: restore RCU grace period in tcp_ao_destroy_sock\n\nCommit 51e547e8c89c (\"tcp: Free TCP-AO/TCP-MD5 info/keys without RCU\")\nremoved the call_rcu() callback from tcp_ao_destroy_sock(), arguing that\n\"the destruction of info/keys is delayed until the socket destructor\"\nand therefore \"no one can discover it anymore\".\n\nThat argument does not hold for the call site in tcp_connect()\n(net/ipv4/tcp_output.c:4327-4332). At that point the socket is in\nTCP_SYN_SENT, has already been inserted into the inet ehash by\ninet_hash_connect() in tcp_v4_connect(), and is therefore very much\ndiscoverable: any softirq running tcp_v4_rcv() on another CPU can take\nthe socket out of the ehash, walk into tcp_inbound_hash(), and load\ntp->ao_info via implicit RCU before bh_lock_sock_nested() is taken on\nthe destroying CPU.\n\nThe reader path then enters __tcp_ao_do_lookup() (net/ipv4/tcp_ao.c:208)\nwhich re-loads tp->ao_info via rcu_dereference_check(); the re-load can\nstill observe the (about-to-be-freed) pointer because there is no\nsynchronize_rcu() between rcu_assign_pointer(tp->ao_info, NULL) and\ntcp_ao_info_free() in tcp_ao_destroy_sock(). The captured pointer is\nthen walked at line 223:\n\n\thlist_for_each_entry_rcu(key, &ao->head, node, ...)\n\nThe writer's synchronous kfree() is free to complete between the line\n218 re-fetch and the line 223 hlist iteration. The slab is reused\n(or simply LIST_POISON1-stamped if not yet reused) and the iteration\nwalks attacker-controlled or poison memory in softirq context.\n\nReproducer (no debug shim, stock x86_64 v7.1-rc2 SMP+KASAN, QEMU+KVM):\nan unprivileged uid=1000 process inside CLONE_NEWUSER|CLONE_NEWNET\ninstalls TCP_MD5SIG + TCP_AO_ADD_KEY on a TCP socket, sprays forged\nTCP-AO segments toward its eventual 4-tuple via raw sockets, then\ncalls connect(). The md5-wins reconciliation in tcp_connect() fires\ntcp_ao_destroy_sock(); the softirq backlog reader on the loopback\nNAPI path crashes on the freed ao->head.first walk:\n\n  Oops: general protection fault, probably for non-canonical\n    address 0xfbd59c000000002f\n  KASAN: maybe wild-memory-access in range\n    [0xdead000000000178-0xdead00000000017f]\n  CPU: 0 UID: 1000 PID: 100 Comm: repro_userns\n  RIP: 0010:__tcp_ao_do_lookup+0x107/0x1c0\n  Call Trace: <IRQ>\n    __tcp_ao_do_lookup+0x107/0x1c0\n    tcp_ao_inbound_lookup.constprop.0+0x12a/0x200\n    tcp_inbound_ao_hash+0x5ea/0x1520\n    tcp_inbound_hash+0x7ce/0x1240\n    tcp_v4_rcv+0x1e7a/0x3e10\n    ...\n\nRestore the RCU grace period: re-add struct rcu_head to tcp_ao_info\nand replace the synchronous tcp_ao_info_free() with a call_rcu()\ncallback. Readers that captured tp->ao_info before rcu_assign_pointer\nNULLed it now see the object remain valid until rcu_read_unlock().\nWith the patch applied the reproducer runs cleanly for 2000 iterations\non the same kernel build."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/tcp_ao.h","net/ipv4/tcp_ao.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"51e547e8c89c661f6fbede4a28b1d33b13625683","lessThan":"657646c08c94ef7b9dbe468fe7828032216f9841","versionType":"git","status":"affected"},{"version":"51e547e8c89c661f6fbede4a28b1d33b13625683","lessThan":"4caf12c778fed3dc3824cf36263be5e2c491fbd0","versionType":"git","status":"affected"},{"version":"51e547e8c89c661f6fbede4a28b1d33b13625683","lessThan":"8bc4d43bccbd60efe85d0a44d5bf41762f2f0c30","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/tcp_ao.h","net/ipv4/tcp_ao.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4caf12c778fed3dc3824cf36263be5e2c491fbd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/657646c08c94ef7b9dbe468fe7828032216f9841","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8bc4d43bccbd60efe85d0a44d5bf41762f2f0c30","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64460","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:31.193","lastModified":"2026-07-27T05:16:52.540","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Skip VF Resizable BAR restore on read error\n\nsriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register\nto decide how many VF BARs to restore (nbars) and which VF BAR each\niteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],\nwhich has only PCI_SRIOV_NUM_BARS (6) entries.\n\nWhen a device does not respond, config reads typically return\nPCI_ERROR_RESPONSE (~0).  Both fields are 3 bits wide, so nbars and bar_idx\nboth evaluate to 7. The barsz[] access then goes out of bounds.  UBSAN\nreports this as:\n\n  UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'\n\nObserved on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding\nduring a failed GC6 power state exit. The subsequent pci_restore_state()\ninvoked sriov_restore_vf_rebar_state() while config reads returned\n0xffffffff, triggering the splat.\n\nBail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.\nNo further VF BARs are touched, which is safe because a config read that\nreturns PCI_ERROR_RESPONSE indicates the device is unreachable and\nrestoration is pointless. This mirrors the guard in\npci_restore_rebar_state()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","lessThan":"b77524621250407386f44c6eea7e5e4619ada1ce","versionType":"git","status":"affected"},{"version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","lessThan":"55fd485e66d0ad5c762c23dba1461fe9c741cd96","versionType":"git","status":"affected"},{"version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","lessThan":"f34f1712229d71ce4286440fef12526fd4590b37","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":5.3}]},"references":[{"url":"https://git.kernel.org/stable/c/55fd485e66d0ad5c762c23dba1461fe9c741cd96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b77524621250407386f44c6eea7e5e4619ada1ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f34f1712229d71ce4286440fef12526fd4590b37","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64463","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:31.543","lastModified":"2026-07-27T05:16:52.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpci_rt1711h: unregister TCPCI port with devres\n\nrt1711h_probe() registers the TCPCI port before requesting the interrupt\nand enabling alert interrupts. If either of those later steps fails, the\nprobe function returns without unregistering the TCPCI port. The explicit\nunregister currently only happens from the remove callback.\n\nRegister a devres action immediately after tcpci_register_port() succeeds,\nso tcpci_unregister_port() runs on later probe failures and on driver\ndetach. Drop the remove callback to avoid unregistering the same port\ntwice.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/typec/tcpm/tcpci_rt1711h.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"302c570bf36e997d55ad0d60628a2feec76954a4","lessThan":"ce2e36e8759dfbfe546723810c306f42f484866d","versionType":"git","status":"affected"},{"version":"302c570bf36e997d55ad0d60628a2feec76954a4","lessThan":"94b1abf1af94aa5a355e9f03675e07bccfc41c4b","versionType":"git","status":"affected"},{"version":"302c570bf36e997d55ad0d60628a2feec76954a4","lessThan":"e5406c8fb71cd2f89a46300a746f6e7972e621e8","versionType":"git","status":"affected"},{"version":"302c570bf36e997d55ad0d60628a2feec76954a4","lessThan":"569f18a83eed0b0be4615f0c7bed40fb5c50e2e6","versionType":"git","status":"affected"},{"version":"302c570bf36e997d55ad0d60628a2feec76954a4","lessThan":"e8da46d99d3710106e7c44db14566bf9b57386b5","versionType":"git","status":"affected"},{"version":"4309ab96ab744703871e35d829177dd9347bf643","versionType":"git","status":"affected"},{"version":"895ec8c86e13f85b119c71d5f95491b48867955e","versionType":"git","status":"affected"},{"version":"745dcedb896a740825160228f98dbb5725a49f85","versionType":"git","status":"affected"},{"version":"4.19.131","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.50","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.7.7","lessThan":"5.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/typec/tcpm/tcpci_rt1711h.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/569f18a83eed0b0be4615f0c7bed40fb5c50e2e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94b1abf1af94aa5a355e9f03675e07bccfc41c4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce2e36e8759dfbfe546723810c306f42f484866d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5406c8fb71cd2f89a46300a746f6e7972e621e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8da46d99d3710106e7c44db14566bf9b57386b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64467","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:32.003","lastModified":"2026-07-27T05:16:52.793","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: use a u64 stride when cleaning up the offsets array\n\nAllocation's Drop walks the offsets array (binder_size_t = u64 entries),\ncleaning up the objects, but it used usize instead of u64 for both the\nstride and the per-entry read.\n\nOn 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels\nit walks the 8-byte entries in 4-byte steps, iterating an N-entry array\n2N times, and reads the always-zero high word as offset 0, cleaning up\nthe object at offset 0 N extra times. As a result the referenced node or\nhandle ends up with a lower reference count than it actually has (a\nrefcount over-decrement), and binder's reference accounting is corrupted;\nfor example, the owner can be notified of a strong reference release\n(BR_RELEASE) even though references still remain.\n\nChange the stride to u64, and read each entry as a u64, narrowing it to\nusize with try_into().\n\nOn 32-bit ARM, when this over-decrement would drive a count below zero,\nthe driver's existing refcount guard refuses it and fires:\n\n  rust_binder: Failure: refcount underflow!"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/android/binder/allocation.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","lessThan":"89b8cc948dce661af87527623b3a41cdd115e2f9","versionType":"git","status":"affected"},{"version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","lessThan":"74920b1b4e474ba7a4de4323c0458deec49d210b","versionType":"git","status":"affected"},{"version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","lessThan":"803c8a9502e9b97cd6ae937618ef4a8fd6274343","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/android/binder/allocation.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64468","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:32.103","lastModified":"2026-07-27T05:16:52.920","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_free_transaction()\n\nIn binder_free_transaction(), the t->to_proc is read under the t->lock.\nHowever, once the t->lock is dropped, the to_proc can die in parallel.\nThis leads to a use-after-free error when we attempt to acquire its\ninner lock right afterwards:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0\n  Write of size 4 at addr ffff00001125da70 by task B/672\n\n  CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   _raw_spin_lock+0xe4/0x1a0\n   binder_free_transaction+0x8c/0x320\n   binder_send_failed_reply+0x21c/0x2f8\n   binder_thread_release+0x488/0x7e0\n   binder_ioctl+0x12c0/0x29a0\n  [...]\n\n  Allocated by task 675:\n   __kmalloc_cache_noprof+0x174/0x444\n   binder_open+0x118/0xb70\n   do_dentry_open+0x374/0x1040\n   vfs_open+0x58/0x3bc\n  [...]\n\n  Freed by task 212:\n   __kasan_slab_free+0x58/0x80\n   kfree+0x1a0/0x4a4\n   binder_proc_dec_tmpref+0x32c/0x5e0\n   binder_deferred_func+0xc48/0x104c\n   process_one_work+0x53c/0xbc0\n  [...]\n  ==================================================================\n\nTo prevent this, pin the target thread (t->to_thread) to guarantee the\ntarget process remains alive. Undelivered transactions without a target\nthread are already safe, as the target process can only be the current\ncontext in those paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"5602a43f251c3d75312df91a422675fc00ca3dce","versionType":"git","status":"affected"},{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"0be901ab1dcc4af59b88f2e324493bb283850167","versionType":"git","status":"affected"},{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"48aeda9f8039e4a6971d1804578efde7f2c01eda","versionType":"git","status":"affected"},{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"45df558c543bb5543bacc8065fd7c567740781e5","versionType":"git","status":"affected"},{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"d45ef513eed1abebfec90c3cfb6ae50c2a4182db","versionType":"git","status":"affected"},{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"328ccf32acb87e8bbb1fe2b065068c574e4db2bf","versionType":"git","status":"affected"},{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"0f15f0f6ca5df566275ce517f257af2559528b41","versionType":"git","status":"affected"},{"version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","lessThan":"f223d27a546c1e1f48d38fd67760e78f068fe8c4","versionType":"git","status":"affected"},{"version":"a4a3c070b8760f71c8311399fa9bfe67c8629bca","versionType":"git","status":"affected"},{"version":"22068d49d09d2b3890e19d7b2048a33340f992da","versionType":"git","status":"affected"},{"version":"0e3b977a8f1be01dcfa0baae68851b1f55f2a0a9","versionType":"git","status":"affected"},{"version":"4.14.136","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.64","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.1.15","lessThan":"5.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64469","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:32.247","lastModified":"2026-07-27T05:16:53.463","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_thread_release()\n\nWhen a thread exits, binder_thread_release() walks its transaction stack\nto clear the t->from and t->to_proc that correspond with the exiting\nthread. However, a process dying in parallel might attempt to kfree some\nof these transactions. And if one of them has no associated t->to_proc,\nthe t->to_proc->inner_lock will not be acquired.\n\nThis means that transaction accesses in binder_thread_release() after\nt->to_proc has been cleared might race with binder_free_transaction()\nand cause a use-after-free error as reported by KASAN:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798\n  Write of size 8 at addr ffff000016627500 by task X/715\n\n  CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   binder_thread_release+0x5d0/0x798\n   binder_ioctl+0x12c0/0x299c\n   [...]\n\n  Allocated by task 717 on cpu 18 at 67.267803s:\n   __kasan_kmalloc+0xa0/0xbc\n   __kmalloc_cache_noprof+0x174/0x444\n   binder_transaction+0x554/0x8150\n   binder_thread_write+0xa30/0x4354\n   binder_ioctl+0x20f0/0x299c\n   [...]\n\n  Freed by task 202 on cpu 18 at 90.416221s:\n   __kasan_slab_free+0x58/0x80\n   kfree+0x1a0/0x4a4\n   binder_free_transaction+0x150/0x294\n   binder_send_failed_reply+0x398/0x6d8\n   binder_release_work+0x3e4/0x4ec\n   binder_deferred_func+0xbd8/0x104c\n   [...]\n  ==================================================================\n\nIn order to avoid this, make sure that binder_free_transaction() reads\nthe t->to_proc under the transaction lock. This will serialize the\ntransaction release with the accesses in binder_thread_release(). Plus,\nit matches the documented locking rules for @to_proc."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082","versionType":"git","status":"affected"},{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"df1a17abba8d6fac5f965adcb8113ceace6e4949","versionType":"git","status":"affected"},{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"38e1a71728e5795b670cc159c18e286a40aeebb4","versionType":"git","status":"affected"},{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"faa070c7ad8ba25dcd0b12d7cdbb419e336f5391","versionType":"git","status":"affected"},{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"e63032dc715026a96bcaa13d375a8e15c91caa84","versionType":"git","status":"affected"},{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"ea02df466df60ecd758eb3b4df3f0cadc5c886ce","versionType":"git","status":"affected"},{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"ef5439ba5b9ac93349f5df12ef88b42a0ce26340","versionType":"git","status":"affected"},{"version":"7a4408c6bd3eb1dafba67986259191be081e3efb","lessThan":"114a116aaa5f0295376cdf12da743c5bce3b20ce","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64475","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:32.980","lastModified":"2026-07-27T05:16:53.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Release the VGA arbiter client on register_device() failure\n\nThe re-order in the Fixes commit below displaced vfio_pci_vga_init() as\nthe last failure point of what is now vfio_pci_core_register_device()\nwithout introducing an unwind for the VGA arbiter registration.\n\nIn current kernels this is mostly benign because vfio_pci_set_decode()\nonly uses pci_dev state, but the original failure path could leave a\ncallback with a freed vdev cookie.  The stale registration also becomes\nunsafe again once the callback follows drvdata to the vfio device.\n\nAdd the required VGA unwind callout."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vfio/pci/vfio_pci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"87856f9af04eaacf9848710625a4ffee1d020fa9","lessThan":"0f2a35a0c7ea7da347b814750eaa78adf3582381","versionType":"git","status":"affected"},{"version":"4aeec3984ddc853f7c65903bde472ffdef738bae","lessThan":"8d65decde9afd2bd78bcfffdc0df73b82a0b5509","versionType":"git","status":"affected"},{"version":"4aeec3984ddc853f7c65903bde472ffdef738bae","lessThan":"ef4c38d30b3744e89eb5048218904bb629ea8d47","versionType":"git","status":"affected"},{"version":"4aeec3984ddc853f7c65903bde472ffdef738bae","lessThan":"9e0a3f642e607848669235f5069f35640abbfc88","versionType":"git","status":"affected"},{"version":"4aeec3984ddc853f7c65903bde472ffdef738bae","lessThan":"42d758a09d2c46c42357ecde9a5492f015bde2e5","versionType":"git","status":"affected"},{"version":"4aeec3984ddc853f7c65903bde472ffdef738bae","lessThan":"52adb2dff7ce3d8430e2bdc5988b618a430def85","versionType":"git","status":"affected"},{"version":"4aeec3984ddc853f7c65903bde472ffdef738bae","lessThan":"278a5659c391fe5afe5f9ce1bad1fd24e90144f1","versionType":"git","status":"affected"},{"version":"4aeec3984ddc853f7c65903bde472ffdef738bae","lessThan":"daedde7f024ecf88bc8e832ed40cf2c795f0796a","versionType":"git","status":"affected"},{"version":"d62dccb417cf972c978bf3c68a7d5e846bcf953e","versionType":"git","status":"affected"},{"version":"6694b8daffac5a8661071f085608afc78f7acd08","versionType":"git","status":"affected"},{"version":"5.10.37","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.11.21","lessThan":"5.12","versionType":"semver","status":"affected"},{"version":"5.12.4","lessThan":"5.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vfio/pci/vfio_pci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/278a5659c391fe5afe5f9ce1bad1fd24e90144f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42d758a09d2c46c42357ecde9a5492f015bde2e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52adb2dff7ce3d8430e2bdc5988b618a430def85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e0a3f642e607848669235f5069f35640abbfc88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/daedde7f024ecf88bc8e832ed40cf2c795f0796a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef4c38d30b3744e89eb5048218904bb629ea8d47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64481","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:33.733","lastModified":"2026-07-27T05:16:54.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/cs35l41: Fix firmware load work teardown\n\ncs35l41_hda creates ALSA controls whose private data points at the\ncs35l41_hda object. The firmware load control can also queue\nfw_load_work.\n\nThose controls are not removed on component unbind, and device remove\nonly cancels fw_load_work through cs35l41_remove_dsp(). That helper is\nskipped when halo_initialized is false. With firmware_autostart\ndisabled, a firmware load can be requested before the DSP has been\ninitialized. If the component or device is removed before the queued\nwork runs, the worker can run after teardown and dereference driver\nstate that is no longer valid.\n\nTrack the created controls and remove them on unbind so no new control\ncallback can reach the driver data or queue more work. Then cancel\nfw_load_work to drain any request that was already queued. Also cancel\nthe work unconditionally during device remove before runtime PM teardown."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/hda/codecs/side-codecs/cs35l41_hda.c","sound/hda/codecs/side-codecs/cs35l41_hda.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8","lessThan":"8947215c0136c9d905e4a46d824824f8b48a2e5b","versionType":"git","status":"affected"},{"version":"47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8","lessThan":"ce0a903d0591e3e2c790c5b628802b08d1b287cc","versionType":"git","status":"affected"},{"version":"47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8","lessThan":"d6a40a4d083ef74d00c8f9516cb5ff07ac70720b","versionType":"git","status":"affected"},{"version":"47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8","lessThan":"b65020d5398f499c09498c9786dba6d67ae57664","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/hda/codecs/side-codecs/cs35l41_hda.c","sound/hda/codecs/side-codecs/cs35l41_hda.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6a40a4d083ef74d00c8f9516cb5ff07ac70720b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64485","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:34.203","lastModified":"2026-07-27T05:16:54.570","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: compress: Fix task creation error unwind\n\nsnd_compr_task_new() allocates the driver task before validating the\nreturned DMA buffers and reserving file descriptors. When either of\nthose later steps fails, the core frees its task wrapper and DMA-buffer\nreferences without calling the driver's task_free() callback. Any\ndriver resources allocated by task_create() are therefore leaked.\n\nThe dual-fd allocation path also jumps to cleanup without storing the\nnegative get_unused_fd_flags() result in retval. Since retval still\ncontains the successful task_create() return value, TASK_CREATE can\nincorrectly report success although the task was discarded.\n\nPreserve the fd allocation errors and call task_free() when failure\noccurs after a successful task_create() callback."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/compress_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"04177158cf98a79744937893b100020d77e6f9ac","lessThan":"b27a75d42044d9d4709095617730b91b1c4af423","versionType":"git","status":"affected"},{"version":"04177158cf98a79744937893b100020d77e6f9ac","lessThan":"426a9947a38d272d0e19c031658da68e31128667","versionType":"git","status":"affected"},{"version":"04177158cf98a79744937893b100020d77e6f9ac","lessThan":"4a60127debb9e370d6c0e22a307326b624a141f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/compress_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/426a9947a38d272d0e19c031658da68e31128667","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a60127debb9e370d6c0e22a307326b624a141f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b27a75d42044d9d4709095617730b91b1c4af423","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64490","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:34.807","lastModified":"2026-07-27T05:16:54.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/virtio/virtio_kctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d6568e3de42dd971a1356f7ba581e6600d53f0a0","lessThan":"3243563f99ef5d3949b934bd6390a5679405d0e1","versionType":"git","status":"affected"},{"version":"d6568e3de42dd971a1356f7ba581e6600d53f0a0","lessThan":"5da9742de22db0dbaa8d414214ab5e1bedde00f9","versionType":"git","status":"affected"},{"version":"d6568e3de42dd971a1356f7ba581e6600d53f0a0","lessThan":"21584672fd699abe1768241d6c501b2de6139b6a","versionType":"git","status":"affected"},{"version":"d6568e3de42dd971a1356f7ba581e6600d53f0a0","lessThan":"c77a6cbb36ff8cbc1f084d94f8dcda5250935271","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/virtio/virtio_kctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64496","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:35.490","lastModified":"2026-07-27T05:16:54.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: event: Fix event FIFO reset race\n\n`iio_event_getfd()` creates the event file descriptor with\n`anon_inode_getfd()`, which allocates a new fd, creates the anonymous\nfile and installs it in the process fd table before returning to the\ncaller.\n\nThe IIO code resets the event FIFO after `anon_inode_getfd()` has returned,\nbut before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.\nBut since fd tables are shared between threads, another thread can guess\nthe newly allocated fd number and issue a `read()` on it as soon as the fd\nhas been installed.\n\nThis means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in\nparallel with the `kfifo_reset_out()` in `iio_event_getfd()`.\n\nThe kfifo documentation says that `kfifo_reset_out()` is only safe when it\nis called from the reader thread and there is only one concurrent reader.\nOtherwise it is dangerous and must be handled in the same way as\n`kfifo_reset()`.\n\nIf that happens, `kfifo_to_user()` can advance the FIFO `out` index based\non state from before the reset, after the reset has already moved the `out`\nindex to the current `in` index. That can leave the FIFO with an `out`\nindex past the `in` index. A later `read()` can then see an underflowed\nFIFO length and copy more data than the event FIFO buffer contains. This\ncan result in an out-of-bounds read and leak adjacent kernel memory to\nuserspace.\n\nMove the FIFO reset before `anon_inode_getfd()`. At that point the event fd is\nmarked busy, but the new fd has not been installed yet, so userspace cannot\naccess it while the FIFO is reset."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iio/industrialio-event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"9dc84ba4be5bbeb29ee49efe6cea2cb32c461424","versionType":"git","status":"affected"},{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"d16a702ca7d29c0b7a9b509339d1b044a1cadb32","versionType":"git","status":"affected"},{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"a13ef1adbc62085b21b546b07b0be7e2fbf52150","versionType":"git","status":"affected"},{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"0d4a646d7f87ea3625fafe387043fddc6a2f5e7f","versionType":"git","status":"affected"},{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"72c6aa8e0d74eab91b8694cde97dec088c248fee","versionType":"git","status":"affected"},{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"9edefd4c56bee3fe331e0355d1f10a533134999d","versionType":"git","status":"affected"},{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"f187dc5a4c4846ffa07d9bda6e760837ed005574","versionType":"git","status":"affected"},{"version":"b91accafbb1031b80d22ad83576877ff2f8b4774","lessThan":"af791d295737ea6b6ff2c8d8488462a49c14af01","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iio/industrialio-event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0d4a646d7f87ea3625fafe387043fddc6a2f5e7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72c6aa8e0d74eab91b8694cde97dec088c248fee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9dc84ba4be5bbeb29ee49efe6cea2cb32c461424","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9edefd4c56bee3fe331e0355d1f10a533134999d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a13ef1adbc62085b21b546b07b0be7e2fbf52150","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af791d295737ea6b6ff2c8d8488462a49c14af01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d16a702ca7d29c0b7a9b509339d1b044a1cadb32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f187dc5a4c4846ffa07d9bda6e760837ed005574","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64501","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:36.090","lastModified":"2026-07-27T05:16:55.100","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix CS held asserted and state leaks\n\nIn ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and\ndisable_one() were called from the out: block while keep_cs_asserted\nwas still true. This caused any SPI transfer issued by those callbacks\nto carry cs_change=1, leaving CS permanently asserted after the\nconversion. Fix by moving both calls into the out_unlock: block, after\nkeep_cs_asserted is cleared, matching the pattern already used in\nad_sd_calibrate().\n\nIn the error path of ad_sd_buffer_postenable(), if an operation fails\nafter set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g.\nspi_offload_trigger_enable()), the device is left in continuous\nconversion mode with CS physically asserted. Additionally,\nbus_locked remaining true after spi_bus_unlock() causes subsequent\nSPI operations to call spi_sync_locked() without the bus lock actually\nheld, allowing concurrent SPI access.\n\nFix the error path by clearing keep_cs_asserted first, then calling\nset_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS,\nthen clearing bus_locked before releasing the bus.\n\nFor devices that implement neither set_mode nor disable_one (such as\nMAX11205, which has no physical CS pin), no SPI transfer is issued\nduring cleanup and the cs_change flag has no effect on any physical\nline."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iio/adc/ad_sigma_delta.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"132d44dc6966c1cf841ffe0f6f048165687e870b","lessThan":"c313bb7c38855e94ceef939d152dd75e5a904b5f","versionType":"git","status":"affected"},{"version":"132d44dc6966c1cf841ffe0f6f048165687e870b","lessThan":"f1de829ee87a1198d3465493ce430d36c5fa029c","versionType":"git","status":"affected"},{"version":"132d44dc6966c1cf841ffe0f6f048165687e870b","lessThan":"c72da0688575e5ef39c36bb44fed53aa18f8ae65","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iio/adc/ad_sigma_delta.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/c313bb7c38855e94ceef939d152dd75e5a904b5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c72da0688575e5ef39c36bb44fed53aa18f8ae65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1de829ee87a1198d3465493ce430d36c5fa029c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64502","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:36.200","lastModified":"2026-07-27T05:16:55.223","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices\n\nad_sigma_delta_clear_pending_event() falls through to the status register\nread path for devices with has_registers = false and no rdy_gpiod. For\nsuch devices, ad_sd_read_reg() skips the address byte entirely and clocks\nraw MISO bytes with no address phase — making it byte-for-byte identical\nto reading conversion data. If a pending conversion result is present,\nthis partially consumes it and corrupts the data stream for the subsequent\nad_sd_read_reg() call in ad_sigma_delta_single_conversion().\n\nFurthermore, with num_resetclks = 0 on these devices, data_read_len\nevaluates to 0. If the clocked byte has bit 7 clear, pending_event is set\nand the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to\nSIZE_MAX and corrupting the heap.\n\nFix by returning 0 immediately when neither rdy_gpiod nor has_registers\nis set. This is safe for all current registerless devices: ad7191 and\nad7780 (with powerdown GPIO) are reset between conversions by CS\ndeassertion, so there is no stale result to drain; ad7780 (without\npowerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY\nat the output data rate regardless of whether the previous result was\nread, so the next falling edge fires naturally.\n\nA future registerless device that holds ~DRDY asserted until data is read\nwould be broken by this early return and would require either\nnum_resetclks set or a rdy-gpio.\n\nThe same heap corruption is reachable on any device with rdy_gpiod set\nbut num_resetclks = 0: if the GPIO indicates a pending event, the drain\npath executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers.\nAdd an explicit data_read_len == 0 guard after the pending event check;\nthe stale result is then consumed by the first ad_sd_read_reg() call in\nad_sigma_delta_single_conversion()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iio/adc/ad_sigma_delta.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"132d44dc6966c1cf841ffe0f6f048165687e870b","lessThan":"3394e0b3328422431cadaf314fa58d3717ed4936","versionType":"git","status":"affected"},{"version":"132d44dc6966c1cf841ffe0f6f048165687e870b","lessThan":"3bceb26dfaf7ba805b459e41c1d0ba916862dade","versionType":"git","status":"affected"},{"version":"132d44dc6966c1cf841ffe0f6f048165687e870b","lessThan":"91bc6767a4f55dc470d8a56b55b9f2ea09094efe","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iio/adc/ad_sigma_delta.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3394e0b3328422431cadaf314fa58d3717ed4936","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bceb26dfaf7ba805b459e41c1d0ba916862dade","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91bc6767a4f55dc470d8a56b55b9f2ea09094efe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64505","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:36.583","lastModified":"2026-07-27T05:16:55.357","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: function: rndis: add length check for header\n\nAdd a length check for the rndis header in rndis_rm_hdr, to ensure that\nMessageType, MessageLength, DataOffset, and DataLength fields are\npresent before they are accessed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/rndis.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"200dd5092296ad4d5ae47f8445a2fb1edd1da973","versionType":"git","status":"affected"},{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"9ffd567d7bf269824dfac06f8ab9a32fef72699b","versionType":"git","status":"affected"},{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"b73c0142e3acdc063b50c33afb7be19cdb2cd410","versionType":"git","status":"affected"},{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433","versionType":"git","status":"affected"},{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"ba2cc601e59fe68716646199a33303493513e2e3","versionType":"git","status":"affected"},{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"7515a6d4a9e9e4838b833825882efa00e85f8901","versionType":"git","status":"affected"},{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"9facd79028a7807879eb441d12f0e00720980aa3","versionType":"git","status":"affected"},{"version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","lessThan":"21b5bf155435008e0fb0736795289788e63d426f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/rndis.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/200dd5092296ad4d5ae47f8445a2fb1edd1da973","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21b5bf155435008e0fb0736795289788e63d426f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7515a6d4a9e9e4838b833825882efa00e85f8901","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9facd79028a7807879eb441d12f0e00720980aa3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ffd567d7bf269824dfac06f8ab9a32fef72699b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b73c0142e3acdc063b50c33afb7be19cdb2cd410","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba2cc601e59fe68716646199a33303493513e2e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64507","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:36.810","lastModified":"2026-07-27T05:16:55.487","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/include/asm/nospec-branch.h","arch/x86/kernel/cpu/bugs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"cb27f3bf915cc0f20fc0c48da9059304e39ebd35","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"9354248fc1c33a844ca1872761f6668b393e8c37","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"52440e15d9628f8f239373c0f2e5e8f92feea2df","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"a3af84b0fa00ead01fcd0e28b5d773ff25990a0d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/include/asm/nospec-branch.h","arch/x86/kernel/cpu/bugs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64508","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:36.920","lastModified":"2026-07-27T05:16:55.600","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don't reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/filter.h","kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"6e52c240c43a601b681e3a4e58fc5685114d4726","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"eed774da601268dae674e14d54a15e3624691f52","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"8ff183ee4d8c452960df58175a094828c0513b2e","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"7a6c171c6a1ac6d1509752dac131d941a3de0b37","versionType":"git","status":"affected"},{"version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","lessThan":"96cce16e26dd02a8678f1e87f88a4b5cdb63b995","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/filter.h","kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64510","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:37.137","lastModified":"2026-07-27T05:16:55.720","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix acpi_nfit_init() error cleanup\n\nIf acpi_nfit_init() fails after adding the acpi_desc object to the\nacpi_descs list, that object is never removed from that list because\nthe acpi_nfit_shutdown() devm action is not added for the NFIT device\nin that case.  Next, the acpi_nfit_init() failure causes\nacpi_nfit_probe() to fail, the acpi_desc object is freed, and a\ndangling pointer is left behind in the acpi_descs.  Any subsequent\nACPI Machine Check Exception will trigger nfit_handle_mce() which\niterates over acpi_descs and so a use-after-free will occur.\n\nMoreover, if acpi_nfit_probe() returns 0 after installing a notify\nhandler for the NFIT device and without allocating the acpi_desc\nobject and setting the NFIT device's driver data pointer, the\nacpi_desc object will be allocated by acpi_nfit_update_notify()\nand acpi_nfit_init() will be called to initialize it.  Regardless\nof whether or not acpi_nfit_init() fails in that case, the\nacpi_nfit_shutdown() devm action is not added for the NFIT device\nand acpi_desc is never removed from the acpi_descs list.  If the\nacpi_desc object is freed subsequently on driver removal, any\nsubsequent ACPI MCE will lead to a use-after-free like in the\nprevious case.\n\nTo address the first issue mentioned above, make acpi_nfit_probe()\ncall acpi_nfit_shutdown() directly on acpi_nfit_init() failures and\nto address the other one, add a remove callback to the driver and\nmake it call acpi_nfit_shutdown().  Also, since it is now possible to\npass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it\nmay not have been initialized, add checks against NULL for acpi_desc and\nits nvdimm_bus field to that function and make acpi_nfit_unregister()\nclear the latter after unregistering the NVDIMM bus."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/nfit/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"ee82078e776ae31266cc70fdf62ac17c3c6f100a","versionType":"git","status":"affected"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"6ff054cc02a763914773b026cacb429e5fbf64fa","versionType":"git","status":"affected"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4","versionType":"git","status":"affected"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"c127dbd832bd4b9aef8a749d9f491b74042f9b47","versionType":"git","status":"affected"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"df7c92216a1583a76cb0cbf2f21cd68870609b05","versionType":"git","status":"affected"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa","versionType":"git","status":"affected"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"7d69235bdc581a4346e9bcd6a8bea37d3e1abd25","versionType":"git","status":"affected"},{"version":"a61fe6f7902ecaa89d5e6c709490fc4324927134","lessThan":"38bf27511ef41bffebd157ec3eba41fc89ba59cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/nfit/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64515","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:37.763","lastModified":"2026-07-27T05:16:55.870","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix MLE defragmentation\n\nIf either reconf or EPCS multi-link element (MLE) is contained in\na non-transmitted profile, the defragmentation routine is called\nwith a pointer to the defragmented copy, but the original elements.\n\nThis is incorrect for two reasons:\n - if the original defragmentation was needed, it will not find the\n   correct data\n - if the original frame is at a higher address, the parsing will\n   potentially overrun the heap data (though given the layout of\n   the buffers, only into the new defragmentation buffer, and then\n   it has to stop and fail once that's filled with copied data.\n\nFix it by tracking the container along with the pointer and in\ndoing so also unify the two almost identical defragmentation\nroutines."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/parse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff","lessThan":"1f573e17bcb7275ddd1c8f47f46ae0faf0e902a4","versionType":"git","status":"affected"},{"version":"4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff","lessThan":"55c479aae99b120489a432db9c717484e523dfd6","versionType":"git","status":"affected"},{"version":"4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff","lessThan":"722b3f86df80644463d29fe5451e30a617f74500","versionType":"git","status":"affected"},{"version":"4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff","lessThan":"a74e893f30db64cdce0fc7a96d3baa417bcd55f5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/parse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.5}]},"references":[{"url":"https://git.kernel.org/stable/c/1f573e17bcb7275ddd1c8f47f46ae0faf0e902a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55c479aae99b120489a432db9c717484e523dfd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/722b3f86df80644463d29fe5451e30a617f74500","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a74e893f30db64cdce0fc7a96d3baa417bcd55f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64516","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:37.870","lastModified":"2026-07-27T05:16:55.983","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n\nThe VCPU BO contains the actual FW at an offset, but\nit was not calculated into the VCPU BO size.\nSubtract this from the FW size to make sure there is\nno out of bounds access.\n\nMake sure the stack and data offsets are aligned to\nthe 32K TLB size.\n\nCheck that the FW microcode actually fits in the\nspace that is reserved for it.\n\n(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f","lessThan":"ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4","versionType":"git","status":"affected"},{"version":"d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f","lessThan":"3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64520","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:38.290","lastModified":"2026-07-27T05:16:56.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies\n\nThe register-based PARTITION_INFO_GET path trusted the firmware-provided\nindices when copying partition descriptors into the caller buffer.\nReject inconsistent counts or index progressions so the copy loop cannot\nwrite past the allocated array.\n\n(fixed cur_idx when exactly one descriptor in the first fragment)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/firmware/arm_ffa/driver.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ba85c644ac8dc37d9b01a3332c2f142cb4d46954","lessThan":"f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95","versionType":"git","status":"affected"},{"version":"ba85c644ac8dc37d9b01a3332c2f142cb4d46954","lessThan":"79d95c02ae0a95e6e80e8e92b7ca74ecee02854f","versionType":"git","status":"affected"},{"version":"ba85c644ac8dc37d9b01a3332c2f142cb4d46954","lessThan":"3974ea1938406f9bfa7c1f48d4e43533f447bb08","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/firmware/arm_ffa/driver.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/79d95c02ae0a95e6e80e8e92b7ca74ecee02854f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64522","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:38.497","lastModified":"2026-07-27T05:16:56.213","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA\n\nmlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating\nsoftware state and skipping hardware offload setup.\n\nThat path jumps to the common success label before taking the eswitch mode\nblock. After tunnel-mode validation was moved earlier, the common success\nlabel unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs,\nthis decrements esw->offloads.num_block_mode without a matching increment.\n\nReturn directly after installing the acquire SA offload handle, so only the\npaths that successfully called mlx5_eswitch_block_mode() call the matching\nunblock."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"22239eb258bc1e6ccdb2d3502fce1cc2b2a88386","lessThan":"b5bd4249e430f5963d559708ee96a671716d2400","versionType":"git","status":"affected"},{"version":"22239eb258bc1e6ccdb2d3502fce1cc2b2a88386","lessThan":"ecafd8284e527666e83261e6e57a7c7341d591cb","versionType":"git","status":"affected"},{"version":"22239eb258bc1e6ccdb2d3502fce1cc2b2a88386","lessThan":"abe003b33223ff33552f291644bf35d9c2f992fb","versionType":"git","status":"affected"},{"version":"993c4ba71596c30418ba5a0ddcf4f9c2f431466a","versionType":"git","status":"affected"},{"version":"6.17.4","lessThan":"6.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64523","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:38.597","lastModified":"2026-07-27T05:16:56.327","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Take a long-lived file reference at submit\n\nhandshake_nl_accept_doit() needs the file pointer backing\nreq->hr_sk->sk_socket to survive the window between\nhandshake_req_next() and the subsequent FD_PREPARE() and get_file().\nThe submit-side sock_hold() does not provide that.  sk_refcnt keeps\nstruct sock alive, but struct socket is owned by sock->file: when\nthe consumer fputs the last file reference, sock_release() tears\nthe socket down regardless of any sock_hold.\n\nAdd an hr_file pointer to struct handshake_req and acquire an\nexplicit reference on sock->file during handshake_req_submit().\nhandshake_complete() and handshake_req_cancel() release the\nreference on the completion-bit-winning path.\n\nThe submit error path must also release the file reference, but\nafter rhashtable insertion a concurrent handshake_req_cancel() can\ndiscover the request and race the error path.  Gate the error-path\ncleanup -- sk_destruct restoration, fput, and request destruction\n-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same\nserialization handshake_complete() and handshake_req_cancel()\nalready use.  When cancel has already claimed ownership, the submit\nerror path returns without touching the request; socket teardown\nhandles final destruction.\n\nThe accept-side dereferences are not yet retargeted; that change\ncomes in the next patch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/handshake/handshake.h","net/handshake/netlink.c","net/handshake/request.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","lessThan":"685b10dd0e32c7782cead16c8cf055c609678583","versionType":"git","status":"affected"},{"version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","lessThan":"16eaba5aa89c04eea125905bb8f988c1897f4f29","versionType":"git","status":"affected"},{"version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","lessThan":"09dba37eee70d0596e26645015f1aa95a9848e9d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/handshake/handshake.h","net/handshake/netlink.c","net/handshake/request.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64524","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:38.713","lastModified":"2026-07-27T05:16:56.447","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hyperv: validate resolution_count and fix WIN8 fallback\n\nA SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past\nthe supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the\nparse loop. Bound resolution_count against the array size, folded\ninto the existing zero-check.\n\nWhen the WIN10 resolution probe fails, the caller in\nhyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated,\nwhich sets mode_config.max_width / max_height to 0 and makes\ndrm_internal_framebuffer_create() reject every userspace framebuffer\nwith -EINVAL. The pre-WIN10 branch had the same gap for\npreferred_width / preferred_height. Use a single post-probe fallback\nguarded by screen_width_max == 0 so both paths converge on the WIN8\ndefaults."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","lessThan":"96f7de3172d4aa878b7f87173b2b3507c350fcd6","versionType":"git","status":"affected"},{"version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","lessThan":"bc573752f3dac0d1ab8df7078c1851bc76717653","versionType":"git","status":"affected"},{"version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","lessThan":"1fb565b77b8f44afabb02de6310065f109d89e94","versionType":"git","status":"affected"},{"version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","lessThan":"a321c908f2eeea01539668eb270d074d9b88e490","versionType":"git","status":"affected"},{"version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","lessThan":"9c698b2c43c2667c34f5336bf46ad5786216ac2a","versionType":"git","status":"affected"},{"version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","lessThan":"8a114b25b5521eae451b13bce98ae978624962e5","versionType":"git","status":"affected"},{"version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","lessThan":"13d33b9ef67066c77c84273fac5a1d3fde3533d1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/13d33b9ef67066c77c84273fac5a1d3fde3533d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1fb565b77b8f44afabb02de6310065f109d89e94","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a114b25b5521eae451b13bce98ae978624962e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96f7de3172d4aa878b7f87173b2b3507c350fcd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c698b2c43c2667c34f5336bf46ad5786216ac2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a321c908f2eeea01539668eb270d074d9b88e490","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc573752f3dac0d1ab8df7078c1851bc76717653","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64529","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-25T10:17:39.317","lastModified":"2026-07-27T05:16:56.580","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - remove unused character device and IOCTLs\n\nThe QAT driver exposes a character device (qat_adf_ctl) with IOCTLs\nfor device configuration, start, stop, status query and enumeration.\nThese IOCTLs are not part of any public uAPI header and have no known\nin-tree or out-of-tree users. Device lifecycle is already managed via\nsysfs.\n\nThe ioctl interface also increases the attack surface and is the\nsubject of a number of bug reports.\n\nRemove the character device, the IOCTL definitions, and the related\ndata structures (adf_dev_status_info, adf_user_cfg_key_val,\nadf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused\nadf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal\nmodule_init/module_exit hooks for workqueue, AER, and crypto/compression\nalgorithm registration.\n\nClean up leftover dead code that was only reachable from the removed\nIOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),\nadf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),\nadf_get_vf_real_id() and the unused ADF_CFG macros.\n\nAdditionally, drop the entry associated to QAT IOCTLs in\nioctl-number.rst."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/userspace-api/ioctl/ioctl-number.rst","drivers/crypto/intel/qat/qat_common/adf_cfg.c","drivers/crypto/intel/qat/qat_common/adf_cfg.h","drivers/crypto/intel/qat/qat_common/adf_cfg_common.h","drivers/crypto/intel/qat/qat_common/adf_cfg_user.h","drivers/crypto/intel/qat/qat_common/adf_common_drv.h","drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c","drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"071590a44cbc38483fceb1ab943363ec26868e1b","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"1de076f43e64bf65fbe7280a269c70e0e60518df","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"6848a6e39cac44fdb7cb88f0f777df62172d1551","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"b1ea97076bd0a5196290deba172034e480646727","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"b8ebf008696de1ec08c90d51f94d7e40bd448be1","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"de2cc38489b629927910b1aeff69bba7bd5c6f1b","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"3ae49dd04dbb11fb73f17f58a982dba128abe83a","versionType":"git","status":"affected"},{"version":"d8cba25d2c68992a6e7c1d329b690a9ebe01167d","lessThan":"d237230728c567297f2f98b425d63156ab2ed17f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/userspace-api/ioctl/ioctl-number.rst","drivers/crypto/intel/qat/qat_common/adf_cfg.c","drivers/crypto/intel/qat/qat_common/adf_cfg.h","drivers/crypto/intel/qat/qat_common/adf_cfg_common.h","drivers/crypto/intel/qat/qat_common/adf_cfg_user.h","drivers/crypto/intel/qat/qat_common/adf_common_drv.h","drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c","drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.17","status":"affected"},{"version":"0","lessThan":"3.17","versionType":"semver","status":"unaffected"},{"version":"5.10.260","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.211","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.177","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.37","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.14","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1.2","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2024-14040","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-26T07:16:39.583","lastModified":"2026-07-27T05:16:33.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: Increase weight to u16\n\nIn CLOS networks, as link failures occur at various points in the network,\nECMP weights of the involved nodes are adjusted to compensate. With high\nfan-out of the involved nodes, and overall high number of nodes,\na (non-)ECMP weight ratio that we would like to configure does not fit into\n8 bits. Instead of, say, 255:254, we might like to configure something like\n1000:999. For these deployments, the 8-bit weight may not be enough.\n\nTo that end, in this patch increase the next hop weight from u8 to u16.\n\nIncreasing the width of an integral type can be tricky, because while the\ncode still compiles, the types may not check out anymore, and numerical\nerrors come up. To prevent this, the conversion was done in two steps.\nFirst the type was changed from u8 to a single-member structure, which\ninvalidated all uses of the field. This allowed going through them one by\none and audit for type correctness. Then the structure was replaced with a\nvanilla u16 again. This should ensure that no place was missed.\n\nThe UAPI for configuring nexthop group members is that an attribute\nNHA_GROUP carries an array of struct nexthop_grp entries:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tresvd1;\n\t\t__u16\tresvd2;\n\t};\n\nThe field resvd1 is currently validated and required to be zero. We can\nlift this requirement and carry high-order bits of the weight in the\nreserved field:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tweight_high;\n\t\t__u16\tresvd2;\n\t};\n\nKeeping the fields split this way was chosen in case an existing userspace\nmakes assumptions about the width of the weight field, and to sidestep any\nendianness issues.\n\nThe weight field is currently encoded as the weight value minus one,\nbecause weight of 0 is invalid. This same trick is impossible for the new\nweight_high field, because zero must mean actual zero. With this in place:\n\n- Old userspace is guaranteed to carry weight_high of 0, therefore\n  configuring 8-bit weights as appropriate. When dumping nexthops with\n  16-bit weight, it would only show the lower 8 bits. But configuring such\n  nexthops implies existence of userspace aware of the extension in the\n  first place.\n\n- New userspace talking to an old kernel will work as long as it only\n  attempts to configure 8-bit weights, where the high-order bits are zero.\n  Old kernel will bounce attempts at configuring >8-bit weights.\n\nRenaming reserved fields as they are allocated for some purpose is commonly\ndone in Linux. Whoever touches a reserved field is doing so at their own\nrisk. nexthop_grp::resvd1 in particular is currently used by at least\nstrace, however they carry an own copy of UAPI headers, and the conversion\nshould be trivial. A helper is provided for decoding the weight out of the\ntwo fields. Forcing a conversion seems preferable to bending backwards and\nintroducing anonymous unions or whatever."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/nexthop.h","include/uapi/linux/nexthop.h","net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"283a72a5599e80750699d2021830a294ed9ab3f3","lessThan":"b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/nexthop.h","include/uapi/linux/nexthop.h","net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.12","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-64530","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-26T07:16:41.680","lastModified":"2026-07-27T05:16:56.730","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns  in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n  tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n  tc filter add block 10 ... action ct\n\n  (with ct defrag enabled and traffic that produces out-of-order\n  fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"172ba7d46c202e679f3ccb10264c67416aaeb1c4","lessThan":"5ed3d6f85991656667059d3fa5a1d683ac58c447","versionType":"git","status":"affected"},{"version":"0b5b831122fc3789fff75be433ba3e4dd7b779d4","lessThan":"f42e8134a3a1074b834a574d404352f867ba994a","versionType":"git","status":"affected"},{"version":"73f7da5fd124f2cda9161e2e46114915e6e82e97","lessThan":"447d493034a9cf7bf13a2abac86d0573d907ec2f","versionType":"git","status":"affected"},{"version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","lessThan":"e1270e69dcf2c3512c453484178f2e9dc0db3f05","versionType":"git","status":"affected"},{"version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","lessThan":"2140c2f3f2e7b066e1ae616ede8856cafd8015e9","versionType":"git","status":"affected"},{"version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","lessThan":"e28aedab9488343924d227b5a896faed67ce84d5","versionType":"git","status":"affected"},{"version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","lessThan":"a8a02897f2b479127db261de05cbf0c28b98d159","versionType":"git","status":"affected"},{"version":"f5346df0591d10bc948761ca854b1fae6d2ef441","versionType":"git","status":"affected"},{"version":"5.15.148","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.75","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.14","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.7.2","lessThan":"6.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2140c2f3f2e7b066e1ae616ede8856cafd8015e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/447d493034a9cf7bf13a2abac86d0573d907ec2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ed3d6f85991656667059d3fa5a1d683ac58c447","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8a02897f2b479127db261de05cbf0c28b98d159","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1270e69dcf2c3512c453484178f2e9dc0db3f05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e28aedab9488343924d227b5a896faed67ce84d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f42e8134a3a1074b834a574d404352f867ba994a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}]}