{"resultsPerPage":45,"startIndex":0,"totalResults":45,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-02T18:10:07.025","vulnerabilities":[{"cve":{"id":"CVE-2026-104080","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:22.740","lastModified":"2026-11-02T16:17:22.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-valid-token","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-109140","sourceIdentifier":"sep@nlnetlabs.nl","published":"2026-11-02T16:17:26.953","lastModified":"2026-11-02T17:17:34.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart."}],"affected":[{"source":"sep@nlnetlabs.nl","affectedData":[{"vendor":"NLnet Labs","product":"Krill","defaultStatus":"affected","versions":[{"version":"0.16.1","lessThan":"*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"sep@nlnetlabs.nl","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:12:47.575702Z","id":"CVE-2026-109140","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sep@nlnetlabs.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-323"}]}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt","source":"sep@nlnetlabs.nl"}]}},{"cve":{"id":"CVE-2026-109141","sourceIdentifier":"sep@nlnetlabs.nl","published":"2026-11-02T16:17:27.120","lastModified":"2026-11-02T17:17:34.860","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request"}],"affected":[{"source":"sep@nlnetlabs.nl","affectedData":[{"vendor":"NLnet Labs","product":"Krill","defaultStatus":"affected","versions":[{"version":"0.16.1","lessThan":"*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"sep@nlnetlabs.nl","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:11:12.422396Z","id":"CVE-2026-109141","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sep@nlnetlabs.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt","source":"sep@nlnetlabs.nl"}]}},{"cve":{"id":"CVE-2026-109142","sourceIdentifier":"sep@nlnetlabs.nl","published":"2026-11-02T16:17:27.267","lastModified":"2026-11-02T17:17:34.987","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request."}],"affected":[{"source":"sep@nlnetlabs.nl","affectedData":[{"vendor":"NLnet Labs","product":"Krill","defaultStatus":"affected","versions":[{"version":"0.16.1","lessThan":"*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"sep@nlnetlabs.nl","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:10:47.154411Z","id":"CVE-2026-109142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sep@nlnetlabs.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt","source":"sep@nlnetlabs.nl"}]}},{"cve":{"id":"CVE-2026-114408","sourceIdentifier":"emo@eclipse.org","published":"2026-11-02T16:17:27.733","lastModified":"2026-11-02T17:17:35.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing."}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"Eclipse ThreadX","defaultStatus":"unaffected","versions":[{"version":"6.4.5","lessThanOrEqual":"6.5.2.202603a","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"emo@eclipse.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:18:37.472445Z","id":"CVE-2026-114408","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Secondary","description":[{"lang":"en","value":"CWE-252"},{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-xjgr-2wmf-f78j","source":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/482","source":"emo@eclipse.org"}]}},{"cve":{"id":"CVE-2026-115653","sourceIdentifier":"emo@eclipse.org","published":"2026-11-02T16:17:28.683","lastModified":"2026-11-02T17:17:35.760","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there."}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"Eclipse ThreadX","defaultStatus":"unaffected","versions":[{"version":"6.0.1","lessThanOrEqual":"6.5.2.202603","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"emo@eclipse.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:17:16.642608Z","id":"CVE-2026-115653","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Secondary","description":[{"lang":"en","value":"CWE-787"},{"lang":"en","value":"CWE-822"}]}],"references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-c38r-v552-gh5g","source":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/503","source":"emo@eclipse.org"}]}},{"cve":{"id":"CVE-2026-115654","sourceIdentifier":"emo@eclipse.org","published":"2026-11-02T16:17:28.877","lastModified":"2026-11-02T17:17:35.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them."}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"Eclipse ThreadX","defaultStatus":"unaffected","versions":[{"version":"6.0.1","lessThanOrEqual":"6.5.2.202603","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"emo@eclipse.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:15:39.674480Z","id":"CVE-2026-115654","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-5q6x-rxf3-5q5f","source":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/502","source":"emo@eclipse.org"}]}},{"cve":{"id":"CVE-2026-120500","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:34.007","lastModified":"2026-11-02T16:17:34.007","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"redimp","product":"otterwiki","defaultStatus":"unaffected","repo":"https://github.com/redimp/otterwiki","packageURL":"pkg:pypi/otterwiki","versions":[{"version":"2.0.0","lessThan":"2.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:05:05.332198Z","id":"CVE-2026-120500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/redimp/otterwiki/commit/b2e91d20ed36c01ce140d18698f9abb90685d481","source":"disclosure@vulncheck.com"},{"url":"https://github.com/redimp/otterwiki/releases/tag/v2.26.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/an-otter-wiki-before-2.26.2-stored-xss-via-math-code-block","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120501","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:34.227","lastModified":"2026-11-02T16:17:34.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"redimp","product":"otterwiki","defaultStatus":"unaffected","repo":"https://github.com/redimp/otterwiki","packageURL":"pkg:pypi/otterwiki","versions":[{"version":"2.20.1","lessThan":"2.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://github.com/redimp/otterwiki/commit/263cac4981f60d92c46adf6386591cf4bc4d6835","source":"disclosure@vulncheck.com"},{"url":"https://github.com/redimp/otterwiki/releases/tag/v2.26.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/an-otter-wiki-2.20.1-before-2.26.2-repository-file-disclosure-via-datatable-src","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-16306","sourceIdentifier":"cret@cert.org","published":"2026-11-02T16:17:34.420","lastModified":"2026-11-02T16:17:34.420","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"INFINITT Healthcare","product":"System Manager","versions":[{"version":"3.0.11.3","lessThanOrEqual":"3.0.11.5","versionType":"custom","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://www.infinittna.com/","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-2102","sourceIdentifier":"b6ef82d7-f637-461b-aedd-74f5857d5f5b","published":"2026-11-02T16:17:40.697","lastModified":"2026-11-02T17:17:43.960","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0."}],"affected":[{"source":"b6ef82d7-f637-461b-aedd-74f5857d5f5b","affectedData":[{"vendor":"Wren Security","product":"wrensec-commons","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"org.wrensecurity.commons:json-resource-http","repo":"https://github.com/WrenSecurity/wrensec-commons/","versions":[{"version":"0","lessThan":"22.6.2","versionType":"semver","status":"affected"},{"version":"23.0.0-M1","lessThan":"23.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"b6ef82d7-f637-461b-aedd-74f5857d5f5b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:14:26.559086Z","id":"CVE-2026-2102","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"b6ef82d7-f637-461b-aedd-74f5857d5f5b","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/WrenSecurity/wrensec-commons/commit/5b50c64c14943b6f4d7faf996345e603956bae1d","source":"b6ef82d7-f637-461b-aedd-74f5857d5f5b"},{"url":"https://github.com/WrenSecurity/wrensec-commons/commit/65bbfd8c63c42e84ff7699aa5b82a22c08a12624","source":"b6ef82d7-f637-461b-aedd-74f5857d5f5b"},{"url":"https://github.com/WrenSecurity/wrensec-commons/security/advisories/GHSA-4vhv-49g2-496q","source":"b6ef82d7-f637-461b-aedd-74f5857d5f5b"}]}},{"cve":{"id":"CVE-2026-77876","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.293","lastModified":"2026-11-02T16:17:43.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77877","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.473","lastModified":"2026-11-02T16:17:43.473","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77878","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.640","lastModified":"2026-11-02T16:17:43.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:49:43.834589Z","id":"CVE-2026-77878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-restoredatabase-api","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77879","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.810","lastModified":"2026-11-02T16:17:43.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":5.2}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-sql-injection-via-access-token-api","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77880","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.973","lastModified":"2026-11-02T16:17:43.973","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77881","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:44.137","lastModified":"2026-11-02T16:17:44.137","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-blind-sql-injection-via-user-parameter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-88809","sourceIdentifier":"meissner@suse.de","published":"2026-11-02T16:17:44.897","lastModified":"2026-11-02T16:17:44.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"SUSE","product":"Rancher","defaultStatus":"unaffected","packageName":"Rancher","repo":"https://github.com/rancher/rancher/","versions":[{"version":"2.15.0","lessThan":"2.15.3","versionType":"semver","status":"affected"},{"version":"2.14.0","lessThan":"2.14.7","versionType":"semver","status":"affected"},{"version":"2.13.0","lessThan":"2.13.11","versionType":"semver","status":"affected"},{"version":"2.12.0","lessThan":"2.12.15","versionType":"semver","status":"affected"},{"version":"2.11.0","lessThan":"2.11.19","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}]},"weaknesses":[{"source":"meissner@suse.de","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-94290","sourceIdentifier":"meissner@suse.de","published":"2026-11-02T16:17:45.190","lastModified":"2026-11-02T17:17:46.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"SUSE","product":"Rancher","defaultStatus":"unaffected","packageName":"Fleet","repo":"https://github.com/rancher/fleet","versions":[{"version":"0.16.0","lessThan":"0.16.3","versionType":"semver","status":"affected"},{"version":"0.15.0","lessThan":"0.15.8","versionType":"semver","status":"affected"},{"version":"0.14.0","lessThan":"0.14.12","versionType":"semver","status":"affected"},{"version":"0.13.0","lessThan":"0.13.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:13:30.631420Z","id":"CVE-2026-94290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-99217","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:45.570","lastModified":"2026-11-02T16:17:45.570","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfork: release the files of a failed fork after sched_cancel_fork()\n\nReorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem\nscx_pre_fork() is safe and isn't held around exiting files. Right now, a\nfork that fails while another thread closed the bpf link fd will\ndeadlock against its own read side. It also blocks every fork on the\nsystem:\n\n copy_process() holds scx_fork_rwsem for read\n exit_files()\n close_files()\n filp_close_sync()\n bpf_scx_unreg()\n kthread_flush_work() waits for the disable work\n scx_root_disable()\n percpu_down_write(&scx_fork_rwsem)\n\nSimply release the child's files after sched_cancel_fork() dropped the\nlock. The task starts out as a copy of its parent so p->files points to\nthe parent's table until copy_files() replaces it. exit_files() must not\nrun for a fork that failed before that. Clear p->files up front so\nexit_files() is a no-op for those and make copy_files() set it\nexplicitly for CLONE_FILES."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"27e1cbf8ec5f7117f6bb2d2e44030ac055f09097","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f7ac8500d58e7684d37403553b1dea90ee2b27b1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"14c7de6ca239326b79fd3f7aee55dfada1bb72ab","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"afa8eb069694bd9f845e5e44eac6e81cbc06780e","versionType":"git","status":"affected"},{"version":"0","lessThan":"6.12.115","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.18.60","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.2.14","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.3.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99218","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:45.740","lastModified":"2026-11-02T16:17:45.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"fd0fbe84312fda2fc187428c92c50b7d03a9d24c","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"71146c437bae59e5280f657965dc6d006ee3989b","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"0fce73efee40c65ce26641c5d93942462f9e8307","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"16e94ed90b1b02398e044d41fd1db34828daa08e","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","lessThan":"2.6.27","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99219","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:45.940","lastModified":"2026-11-02T16:17:45.940","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n Oops: general protection fault\n RIP: 0010:string+0x48/0xe0\n Call Trace:\n vsnprintf+0x1f5/0x650\n seq_printf+0x8e/0xb0\n print_rec+0x6c/0xc0\n t_show+0x4c/0x440\n seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"753d5cba113a52cb155428f4ea93a4b0148c4bf1","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"0e5ff07be834abaf4280e1dca7f9591e339d0960","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"e2e6fb972bfec4a0551bc7c185bdb17f78f94997","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"8932e5a4df110a25578728526bb5a3dbc849d8a2","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"7271c064dd60d4456c5b90da757acd9420d06697","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"d97dba9ff13987d1fc415408557a54adde980311","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0e5ff07be834abaf4280e1dca7f9591e339d0960","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7271c064dd60d4456c5b90da757acd9420d06697","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/753d5cba113a52cb155428f4ea93a4b0148c4bf1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8932e5a4df110a25578728526bb5a3dbc849d8a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d97dba9ff13987d1fc415408557a54adde980311","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2e6fb972bfec4a0551bc7c185bdb17f78f94997","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99220","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.113","lastModified":"2026-11-02T16:17:46.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n \n __key_create_or_update (security/keys/key.c:884)\n key_create_or_update (security/keys/key.c:1021)\n __do_sys_add_key (security/keys/keyctl.c:134)\n do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"889a2293a95f6c2880bf73b67f9b0af23251a128","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"7f0728ba89624e25df2bb80ff59bbfb545060935","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"2a40bdd4409567de4c2a141ac66439dc238af752","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"33a078f04e264eb71aa9f209cb334e4010123818","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"57e54b6939c6539d90a81c7e57531901d5991651","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99221","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.293","lastModified":"2026-11-02T16:17:46.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"4876f09ce222e140a73aad950882b3605440c935","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"2d92a0f87c338a08367aff05edd1ade86da4ac8d","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"234d09bb3b3d84851d4b3246272addc30f3353eb","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"6e359d8cb8580b9874801dea930086effd4d9c62","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"63b19ec2863b2cb5279b746ecd3d6210b1a93945","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"ed697a5f667435bbb1cedbe5bd9f300de645047d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99222","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.460","lastModified":"2026-11-02T16:17:46.460","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the read method check against type removal\n\nkeyctl_read_key() checks key->type->read without holding key->sem.\nA reference keeps the key alive, but does not pin the module containing\nits type. A surviving RxRPC key can therefore be read while AF_RXRPC\nis being unloaded:\n\n KEYCTL_READ task Module unload and key GC\n ---------------- ------------------------\n lookup_user_key()\n permission / possession checks\n load key->type\n af_rxrpc_exit()\n unregister_key_type()\n GC: down_write(key->sem)\n GC: retype to key_type_dead\n GC: up_write(key->sem)\n unregister_key_type() returns\n free_module()\n read saved type's read member\n\nThe final access can read freed module storage. The read invocation in\n__keyctl_read_key() is already protected by key->sem, but the earlier\nmethod check is outside that critical section.\n\nMove the method check into __keyctl_read_key(), after key_validate() and\nunder its existing read hold on key->sem. The check and invocation then\nuse the same protected type for length queries and every read retry.\nThe GC cannot retype the key until the semaphore is released, and type\nunregistration waits for that GC pass before the module can be freed.\n\nReturn -EOPNOTSUPP when validation succeeds and the type has no read\nmethod. A temporary buffer may now be allocated before this result;\nallocation and copying to userspace remain outside the semaphore."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"e5f830ae6611cddbfc504c43f14155f60b63206a","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"1486caee47b4909f52835a957c3293e970113e44","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"ff44f1b303aa76a818d898e85c56ed4852c031e2","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"3edc064069d07e7d37359fcb4d03d3bab15ee3ab","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"e2a2deda08d91644f5e30c17d267b1cdc5f124b2","versionType":"git","status":"affected"},{"version":"7fa67aa30509ad0da72ac0f757aa76e53c0ea3de","versionType":"git","status":"affected"},{"version":"18779eac17b5df9dff57138d07631573553a41d4","versionType":"git","status":"affected"},{"version":"f1afcf9488fc45765e20e2047d3b776981900e0b","versionType":"git","status":"affected"},{"version":"212d3adb1af4e34acb158d6c6def370016a1011d","versionType":"git","status":"affected"},{"version":"4.14.177","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.118","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.35","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.6.7","lessThan":"5.7","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99223","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.650","lastModified":"2026-11-02T16:17:46.650","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring indexes independent of kernel addresses\n\nKEYCTL_READ returns the serial numbers in a keyring in associative-array\ntraversal order. The first word of the index is a public, deterministic\nhash of the type pointer, domain pointer and description. An unprivileged\nuser can therefore insert keys with known descriptions, predict their\norder for each possible KASLR slide, and recover the kernel image address.\nOn an x86-64 build with 16 MiB alignment, 45 user keys suffice to\ndistinguish the candidate slides.\n\nRemove the addresses from the whole index, not just its first hash word.\nAssign each key type and domain a nonzero 64-bit ID and hash those IDs and\nthe description with a once-initialized SipHash key. Use the full IDs in\nthe later index chunks as well. Truncating or hashing the IDs there would\nlose the guarantee that distinct type/domain/description tuples have a\ndiffering index bit.\n\nAllocate IDs lazily since private key types need not be registered. Cache\nthem in the index key so tree walks and copies of an existing index do not\nneed to dereference a type descriptor that may have been unregistered.\nKeep the 32-bit chunk layout and diff_objects() bit offsets consistent,\nand retain the separate root slot for keyrings used by recursive search.\nThe key comparison, permissions and userspace data format are unchanged;\nonly the address-dependent in-memory ordering is replaced."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"9ebe824d55983c9f063a2c9ef1a08b29812d406f","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"e108b22999edbc6f431466baf6b2016c19b7ed31","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"9f084ef0beb68091e96ab96f0e95579aac8a77f9","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"13fc051269d670810d9e314061b61c6dd06116a0","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"61ac0585d9f4344d3dfb84b5edff1fee7d532897","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"84f7c699f8d139f743c7dc11ef41d085690955bb","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"a113eba06bd1183c614d7994864d6e7054140cb9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99224","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.830","lastModified":"2026-11-02T16:17:46.830","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n af_rxrpc_exit() calls unregister_key_type(), which removes the type\n from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n to key_type_dead and completes retirement. Unregistration and module\n exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n BUG: unable to handle page fault for address: fffffbfff8054794\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n RIP: 0010:string+0x23f/0x470\n Call Trace:\n vsnprintf+0x330/0x1110"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"19c4de819e52b7f606468fbfe4fcef4e812e2777","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"916667df7695366f23cfaf365b5840b228cc4b2e","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"dddd3a1ab7d12ee163477918ff6eb943361db4fe","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"3c3cfd9e262afc9558c38f8cec57f09d10988546","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"6b613747f7ea309ada5b8d05b55398c338f7a968","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"dea367df18e3a4faac393e3a4e818ee03af89b19","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"0461bc8f91116aae4a020e15f4e1c1fd535ab35e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.18","status":"affected"},{"version":"0","lessThan":"3.18","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99225","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.047","lastModified":"2026-11-02T16:17:47.047","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Check the authorization payload in process keyring searches\n\nAn authorization payload and its saved credentials must remain valid\nwhile search_process_keyrings_rcu() searches the requestor's keyrings.\nThe function validates the authorization key, then separately loads\npayload.data[0] and unconditionally reads rka->cred. Validation does\nnot prevent request_key_auth_revoke() from clearing the payload.\n\nA request-key helper can assume authority and fork a descendant that\ninherits the authorization key. If the descendant misses in its own\nkeyrings, it falls back to the saved requestor credentials. Successful\ntarget instantiation invalidates the authorization key without clearing\nthe payload. After the helper exits, UMH_WAIT_PROC returns to the\nrequester, which calls complete_request_key() and revokes that key.\n\nWith the descendant paused after validation, the paths can interleave\nas follows:\n\n 1. The descendant enters search_process_keyrings_rcu() under RCU and\n key_validate() succeeds.\n 2. The helper instantiates the target, invalidates the authorization\n key, and exits.\n 3. The requester resumes from UMH_WAIT_PROC, calls\n complete_request_key(), and revokes the authorization key.\n request_key_auth_revoke() sets its payload pointer to NULL.\n 4. The descendant loads NULL and dereferences rka->cred.\n\nThis NULL dereference can oops the kernel. RCU delays payload disposal\nbut does not prevent the pointer from being cleared.\n\nLoad the payload with dereference_key_rcu() and require a non-NULL\nresult before validating the authorization key and searching its saved\ncredentials. A non-NULL payload and its credentials remain alive for\nthe caller's RCU read-side section; a cleared payload skips the fallback\nsearch and follows the existing error selection.\n\nKASAN report as below:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n RIP: 0010:search_process_keyrings_rcu+0x32b/0x790"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/process_keys.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"14fb6fad526b35a7ebd121f1dd313abe652e0aa6","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"7d3d2fffe933e538472ccafe5bbc7109488b9ce3","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"26949c2e4c461e9e620e935bc22717f36a40b615","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"984a178d54515779a1bee100b92a6cee8777c830","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"b86db7993051d05810601654e886a1e78e1fa495","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"b4dfda438fee3c6faa15d9b421c373de6a0e476f","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"49f4e768540d25d8852ef750313afda6a4774871","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/process_keys.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99226","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.233","lastModified":"2026-11-02T16:17:47.233","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Avoid the owner account dereference in named keyring lookup\n\nNamed keyring lookup must keep the storage containing the owner UID\nalive through the namespace mapping check. find_keyring_by_name()\nreads keyring->user->uid under keyring_name_lock, but that lock protects\nthe keyring's name entry and allocation, not its separate key_user.\n\nA named session-keyring join can overlap a privileged KEYCTL_CHOWN on\nanother CPU. If the keyring holds the last reference to its old dynamic\nkey_user and the ownership transfer succeeds, the following ordering is\npossible:\n\n Named join Chown\n find_keyring_by_name() keyctl_chown_key()\n read_lock(keyring_name_lock) down_write(key->sem)\n load old keyring->user\n replace key->user and key->uid\n up_write(key->sem)\n key_put(key)\n key_user_put(old user): free\n read old user->uid\n read_unlock(keyring_name_lock)\n\nChown neither takes keyring_name_lock nor key_session_mutex, so it can\nfree the old account between the pointer load and the UID read. The\nlookup then reads freed memory even though the keyring itself is alive.\n\nUse keyring->uid for the mapping check. key_alloc() initializes this\ninline owner UID and keyctl_chown_key() updates it on chown.\nThe existing name lock keeps its containing keyring allocated throughout\nthe check, so lookup no longer depends on the account's lifetime. This\nalso matches the owner UID used by the permission check.\n\nKASAN report as below:\n\n BUG: KASAN: slab-use-after-free in find_keyring_by_name+0x577/0x5d0\n Read of size 4 at addr ffff8881128ae2ec by task keycase/500"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"77249d4b1bb5ad43552b7023c4a0978937aa7a56","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"0b865fa477d94ac96c26848aab1fd176397de3f6","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"6763329f673d261641c79212abf773af77b2c922","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"aa03c8fb4334f14d218020f7431debf2b7766865","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"c9664f780f861dd9f11f120c7a03ed0993671ebb","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"b0830a26e2c3008a6e21863126b4a0e68b2761cd","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"5c6a9512887a6cc694d594d9c0b57c0841d215b5","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"40b12b93ae4ab9e22c3d571e9b09fd08afad53f6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b865fa477d94ac96c26848aab1fd176397de3f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40b12b93ae4ab9e22c3d571e9b09fd08afad53f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c6a9512887a6cc694d594d9c0b57c0841d215b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6763329f673d261641c79212abf773af77b2c922","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77249d4b1bb5ad43552b7023c4a0978937aa7a56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa03c8fb4334f14d218020f7431debf2b7766865","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0830a26e2c3008a6e21863126b4a0e68b2761cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9664f780f861dd9f11f120c7a03ed0993671ebb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99227","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.420","lastModified":"2026-11-02T16:17:47.420","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: prevent cancel reference wrap\n\nio_waitid packs the cancellation state into bit 31 of ->refs and uses\nbits 30:0 as a 31-bit reference counter:\n\n #define IO_WAITID_CANCEL_FLAG BIT(31)\n #define IO_WAITID_REF_MASK GENMASK(30, 0)\n\n__io_waitid_cancel() marks a request canceled, then increments the low\nbits of ->refs to claim completion ownership. When another path owns the\nrequest, the increment remains even though cancellation returns false.\nThe request remains discoverable by cancellation, so repeated failed\nattempts can wrap the 31-bit reference field to zero. A later\ncancellation can claim ownership and complete the request a second time.\n\nUse atomic_fetch_or() when setting the cancel flag and inspect the old\nflag value. The first cancel attempt continues to the existing ownership\nincrement, preserving its wake and issuer handoff semantics. Later\nattempts see the cancel flag and return without incrementing the\nreference field.\n\nThis makes repeated failed cancellation attempts idempotent while\nleaving the first-cancel state transitions unchanged."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"20b67288574c7c3df6b8ea7ed3b7af90a868006f","versionType":"git","status":"affected"},{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"5bfeee1774791602a0d53eb717f00f172127a017","versionType":"git","status":"affected"},{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","versionType":"git","status":"affected"},{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"22fb4a4518e305164c7f203608287564de292f34","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99228","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.600","lastModified":"2026-11-02T16:17:47.600","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n io_wq_exit_workers() io_worker_handle_work()\n io_wq_worker_wake()\n set TIF_NOTIFY_SIGNAL\n io_assign_current_work()\n io_run_task_work()\n clear TIF_NOTIFY_SIGNAL\n io_wq_submit_work()\n fifo_open()\n wait_for_partner()\n wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/io-wq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"ddccc60f036b309430cf130d48aafed94ef7355a","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"08c42055b8f9a5d29236d34ad4bce08828239fe1","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"62996803c1b5f18176de255db4c843021f2d19c8","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"7309fea05a3d66af9746843c43fef14c10b8141e","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"fdb771015c1e13677b57a4015f0c938748f13781","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/io-wq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99229","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.780","lastModified":"2026-11-02T16:17:47.780","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/wait: don't spin on a stuck overflow list\n\nAs long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()\nreturns right away, before it gets to look at signals or arms the timeout,\nfor io_cqring_wait() to flush the overflow list. If that doesn't empty the\nlist, and the CQ ring doesn't hold the number of events the caller wants,\nthe loop starts over, with the same result. The task spins in the kernel,\nand can't be killed.\n\nThe assumption is that this can't happen: if CQEs can't be flushed, the\nring is full, and min_events is capped to the size of the ring. But:\n\n- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It\n is stuck on the list if a single one is free, and then the ring holds\n less than cq_entries events. A single threaded application that asks\n for as many events as the ring has entries never gets out of\n io_uring_enter().\n\n- Whether the ring is full is up to the CQ head, which the application\n can write to. While one thread waits for events on an empty ring,\n another one can move the head back so that the ring looks full and\n have a CQE overflow. The waiter can't be stopped any more, not even by\n SIGKILL.\n\nOnly the application can make room in the CQ ring. Return to it if the\nlist could not be flushed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/wait.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"bf1d2ed84b3162e3b0e0bb7018ac59147da6e975","versionType":"git","status":"affected"},{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"a6cfc85c6bf9498aaf1978b503f9663635a1aa22","versionType":"git","status":"affected"},{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"4a89352edd8b3e20d1e1fb33f0fc297dd137149f","versionType":"git","status":"affected"},{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"c347691e5dc5481b2d6943c123619e04847fb0dc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/wait.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99230","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.927","lastModified":"2026-11-02T16:17:47.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in ->hash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n RIP: 0010:io_futexv_complete+0x219/0x420\n Call Trace:\n tctx_task_work_run+0x804/0x950\n tctx_task_work+0x71/0xa0\n task_work_run+0x118/0x200\n\nLeave the node unhashed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/uring_cmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"93b8cc60c37b9d17732b7a297e5dca29b50a990d","lessThan":"cc7f13d006fcefed9564bd79f135b51d344e9c77","versionType":"git","status":"affected"},{"version":"93b8cc60c37b9d17732b7a297e5dca29b50a990d","lessThan":"2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707","versionType":"git","status":"affected"},{"version":"93b8cc60c37b9d17732b7a297e5dca29b50a990d","lessThan":"685b49483200384d7f49d338af476e26e6824637","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/uring_cmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99231","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.060","lastModified":"2026-11-02T16:17:48.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: own the request before clearing ->head\n\nio_waitid_remove_wq() only takes the wait queue lock if ->head is set.\nio_waitid_wait() clears ->head first thing, before it tries to become the\nowner of the request by bumping ->refs. If somebody else owns the request\nat that point, nothing keeps it from completing the request while the\nwake up handler is still going to touch it:\n\nCPU0 (io_waitid_wait) CPU1 (io_waitid, holds a ref)\nlist_del_init(&wait->entry)\nsmp_store_release(&iw->head, NULL)\n __do_wait() finds another child\n io_waitid_remove_wq()\n // ->head == NULL, no locking\n io_waitid_finish(), IOU_COMPLETE\n // request freed and reused\natomic_fetch_inc(&iw->refs)\n\nThe same goes for __io_waitid_cancel() if it claims the request in that\nwindow. ->refs is part of the per opcode data of the request, so this\nincrements whatever the next user of the request keeps there. If that\nhappens to be zero, the handler concludes that it owns the request, and\nqueues io_waitid_cb() for it. With the window held open by a delay, and\nthe request reused for a receive that is waiting for data:\n\n BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0\n __wake_up_sync_key+0x36/0x50\n sock_def_readable+0xf1/0x420\n unix_stream_sendmsg+0x60b/0x1110\n Allocated by task 87:\n io_arm_apoll+0x1ed/0x940\n Freed by task 87:\n __io_submit_flush_completions+0x118d/0x1a10\n tctx_task_work_run+0x327/0x950\n\nOnly clear ->head once the handler owns the request. If it doesn't, the\nowner finds ->head set and has to wait for the lock, which is held by the\ncaller of the handler. Deleting the already deleted entry again is\nharmless."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"09951a4d37e33b0197afc7fb77e39f09a3213ee6","lessThan":"bf01da1a9cca4a54e5c30b8344e52c26afb87be7","versionType":"git","status":"affected"},{"version":"934ffdd1cdef232eb125e63c2ebafb7f2deff6af","lessThan":"8381a912c65b8de16e8a848225c7c5a56b6ea834","versionType":"git","status":"affected"},{"version":"ab673c1bcaf20ac70352eeb6bf5b828462676693","lessThan":"c10ad2813e15186fb51b37a4d17fafddc99e89a5","versionType":"git","status":"affected"},{"version":"6.12.113","lessThan":"6.12.115","versionType":"semver","status":"affected"},{"version":"6.18.52","lessThan":"6.18.60","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/8381a912c65b8de16e8a848225c7c5a56b6ea834","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf01da1a9cca4a54e5c30b8344e52c26afb87be7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c10ad2813e15186fb51b37a4d17fafddc99e89a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99232","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.247","lastModified":"2026-11-02T16:17:48.247","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"baa031b7bd2ce7502339174a42974321859ecd6a","lessThan":"e33e2718c62a602001ab549642a1aed0be797105","versionType":"git","status":"affected"},{"version":"baa031b7bd2ce7502339174a42974321859ecd6a","lessThan":"041d1a568a11a7ed7415ef1408d0c65041c1ad69","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99233","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.390","lastModified":"2026-11-02T16:17:48.390","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file->event_call) and adjust se->ref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count. If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse->ref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se->call matches\nfile->event_call before adjusting se->ref."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c","kernel/trace/trace_events_synth.c","kernel/trace/trace_synth.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"381f543ed35c434d5b707369aa5dcd69ecf440af","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"4472579bd1c83708b6fe623c870cdf728e947205","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"23b4106e8b35823acc79e206c7745f55b9cfd78b","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"06e816bed499fe47f39f12044382cc5d064485fb","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"5597bb8db6855fcb97a67196d227fea359bcd81c","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c","kernel/trace/trace_events_synth.c","kernel/trace/trace_synth.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99234","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.597","lastModified":"2026-11-02T16:17:48.597","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n events/sched/sched_waking/trigger\n # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n >> events/sched/sched_switch/trigger\n # cat events/sched/sched_waking/trigger\n hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"f21351d1c4cdcc6a68f03636a407c2af1a5e1e10","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"dba0f492703956801149cc70b39d2650a37995c3","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"a3d7ffd2409700748a495b645948fef48199206e","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"aae0ccd7326eef78dcdefffef3d1253e6f0615ca","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"8482ec5b65f606d5bbcec518e0afc69ad65ca414","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"431959fc76456cbba539279fe8967aa9391e6f23","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"5afb9317e2eeb1c7021a82995ce244fda5a4bd4f","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"d0090baf02dd08f6e909f36f0ad54a4e80f5e79b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99235","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.790","lastModified":"2026-11-02T16:17:48.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist->hist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data->field_var_hists[i]->hist_data->event_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n kfree+0x154/0x420\n event_hist_trigger_free+0x1d5/0x320\n event_hist_trigger_parse+0x35f3/0x69e0\n trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"a6165126b1a1b26342b55be6eb6ee23af8756aba","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"173914501b97236d7ea7dc2af7f30feddd4e1436","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"ac815a379644b2ad5008a009a3516ada31b5dd82","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"8b307d64a60548e4a74cb746f74d7ed4bd49965e","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"7a111ba0d1b74c99bc8f096565dc71945f694254","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"9631dbccd3c649b567a5aafffea6b00634183997","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"7cafc82e6153f05a221be678cd649d02e06ba909","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99236","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.003","lastModified":"2026-11-02T16:17:49.003","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 &&\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_filter.c","tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"4a1a6d35359991c5d47f4bf101cfbe1475c94093","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"2a98f5d4913ec081e08e1075512cb7ec313d9f72","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"15ff3cc7f2beecc3f95d66358f20ad7b057466aa","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"b205ff58e02922ac324f931cf9eb238a3acdb048","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"5a999b5a16530898f0dbe5f8c50fd45ea72e110b","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"1008e9e0b8280d47f1ab5e9c113f666a023a9697","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"64993d970dde2a2da353e9e99595a4fa88ec27d9","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_filter.c","tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99237","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.213","lastModified":"2026-11-02T16:17:49.213","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when resetting last boot data from readers\n\nupdate_last_data_if_empty() is called from tracing_open() with O_TRUNC,\ntracing_read_pipe() and tracing_buffers_read() without trace_types_lock.\nTwo readers can both pass the LAST_BOOT test and free module_delta\ntwice, and a module notifier can update module_delta while it is being\nfreed.\n\nTake trace_types_lock in those paths and keep the callers that already\nhold it on an unlocked variant."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"32dc0042528d385d83bf458e4cf3a49c5110afea","lessThan":"92b69f6db640dadc0851762ee2e12db99f083cad","versionType":"git","status":"affected"},{"version":"32dc0042528d385d83bf458e4cf3a49c5110afea","lessThan":"d6d991afe775ab7fcf89523a2502b7ca3be56ffd","versionType":"git","status":"affected"},{"version":"32dc0042528d385d83bf458e4cf3a49c5110afea","lessThan":"1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92b69f6db640dadc0851762ee2e12db99f083cad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6d991afe775ab7fcf89523a2502b7ca3be56ffd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99238","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.380","lastModified":"2026-11-02T16:17:49.380","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43","lessThan":"57408eac99b0d8a005796346d317d31f0ca4e07a","versionType":"git","status":"affected"},{"version":"5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43","lessThan":"dab2bd4d67ad5eaa95019a9511f8d379401b5021","versionType":"git","status":"affected"},{"version":"5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43","lessThan":"244c442f54601a24c86ad90572bf36fc3df41c5e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dab2bd4d67ad5eaa95019a9511f8d379401b5021","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99239","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.540","lastModified":"2026-11-02T16:17:49.540","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n [Task 1] [Task 2]\n l2cap_chan_connect l2cap_sock_bind\n l2cap_chan_lock lock_sock\n l2cap_state_change if (sk->sk_state != BT_OPEN)\n chan->state = BT_CONNECT\n l2cap_sock_state_change_cb chan->state = BT_BOUND\n sk->sk_state = BT_BOUND\n lock_sock <------------------ release_sock\n sk->sk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk->sk_state, so since chan->state\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan->state. chan->state read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8f90405a4a6f1f1880dc07996b47bf57c712bd8a","lessThan":"85cc289eb08afa975375f838187369e68b429ee0","versionType":"git","status":"affected"},{"version":"32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b","lessThan":"820579652b24ce277e0097cd65b42bd9b7b8bf07","versionType":"git","status":"affected"},{"version":"8922c7940bae9ce4b1736dddb6362370793835c2","lessThan":"e618d928ec7f88cbeadfa3542adcac40f474e629","versionType":"git","status":"affected"},{"version":"91047a4396a8b1857a6f712a90cf33ec0012b189","lessThan":"fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","versionType":"git","status":"affected"},{"version":"0b0e2bf39cf99e458d991b9df253727e036a7d7d","lessThan":"52fe88e4ef87311eee32b45c65603e7c69e75e7d","versionType":"git","status":"affected"},{"version":"d3b739db5dc6f688a60d56da872fabaf65246032","lessThan":"10c705dd706aa93164ba41f2566f15206d6c178e","versionType":"git","status":"affected"},{"version":"b66774b48dd98f07254951f74ea6f513efe7ff8b","lessThan":"73820561d8cbfd3364a29b8fa77f1707f26029da","versionType":"git","status":"affected"},{"version":"b66774b48dd98f07254951f74ea6f513efe7ff8b","lessThan":"d3afd7803f9bc2a8c4270199497b60158b2fc647","versionType":"git","status":"affected"},{"version":"50c38d9f42a529691e4e67ea9cedf4f0bfc8d277","versionType":"git","status":"affected"},{"version":"5.10.265","lessThan":"5.10.273","versionType":"semver","status":"affected"},{"version":"5.15.216","lessThan":"5.15.224","versionType":"semver","status":"affected"},{"version":"6.1.183","lessThan":"6.1.191","versionType":"semver","status":"affected"},{"version":"6.6.145","lessThan":"6.6.161","versionType":"semver","status":"affected"},{"version":"6.12.97","lessThan":"6.12.115","versionType":"semver","status":"affected"},{"version":"6.18.39","lessThan":"6.18.60","versionType":"semver","status":"affected"},{"version":"7.1.4","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99240","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.773","lastModified":"2026-11-02T16:17:49.773","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: error damos_commit_quota_goal() for zero target_value\n\nPatch series \"mm/damon: move zero damos quota target_value handling to the\ncore layer\".\n\nHaving zero DAMOS quota target value can cause division by zero. DAMON\nAPI callers are checking the target value parameters to avoid that. It is\neasy to make mistakes in some of the multiple API callers. Move that to\nthe core layer.\n\nPatch 1 adds the corner case handling into the core layer DAMON parameters\nvalidation logic. Patches 2 and 3 remove no more needed DAMON API callers\nside handling of the corner case in DAMON_LRU_SORT and DMON_SAMPLIE_MTIER,\nrespectively.\n\n\nThis patch (of 3):\n\nIf a DAMOS scheme has a damos_quota_goal of zero target_value,\ndamos_quota_goal() could trigger division-by-zero error. Hence each DAMON\nAPI callers should do the zero target_value validation. It is easy to\nmake mistakes. Actually such bugs in DAMON_LRU_SORT and\nDAMON_SAMPLE_MTIER were found and fixed [1].\n\nIt is better to handle the corner case only once in the core layer,\ninstead of multiple places in all DAMON API callers. One straightforward\noption is using an alternative denominator for the corner case in the\ndamos_quota_goal(). However, the zero target_value is meaningless. In\nthis case, the quota goal is always evaluated as achieved or\nover-achieved. The quota will only keep being reduced.\n\nSimply avoid using zero target_value by adding a check in the core layer\nDAMOS quota goal parameters validation/commit path,\ndamos_commit_quota_goal(). Update it to return an error in the case. \nAlso update its caller to propagate the error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d5482be6243b816730689099c017109eb8730dd5","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cc190c4073f570fd78a9d00dd3d13a71eced5403","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"156aeda4d74e9007b56492ed1f3b5838822632be","versionType":"git","status":"affected"},{"version":"0","lessThan":"6.18.60","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.2.14","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.3.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/156aeda4d74e9007b56492ed1f3b5838822632be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc190c4073f570fd78a9d00dd3d13a71eced5403","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5482be6243b816730689099c017109eb8730dd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99241","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.907","lastModified":"2026-11-02T16:17:49.907","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio. This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\". xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite(). The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9c87959601e80b39a45250e362e6ddfec17cb0fa","lessThan":"57c0d5281666d150c73e56e6795a4eef3ede8693","versionType":"git","status":"affected"},{"version":"9c87959601e80b39a45250e362e6ddfec17cb0fa","lessThan":"0fecc393f2060e6bc25138df32cb923ec7071c6b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99242","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:50.040","lastModified":"2026-11-02T16:17:50.040","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327","versionType":"git","status":"affected"},{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"67aded1da114dc44808315f249bd9e7e440f799d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}]}