Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
411613 vulnerabilities
No criteria set — showing every indexed entry of the selected sources, newest first by published date.
CVE-2026-99261 (GCVE-0-2026-99261)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:25 – Updated: 2026-11-03 11:25
VLAI
EPSS
VEX
Title
drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
It fixes both the move overflow and the eviction fence add for
evicting these per-vm BOs.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 50b24a20be8c0d35f89f7d5c39533f69d84fe48e (git) Affected: 0 , < 7.2.13 (semver) |
|
| Linux | Linux |
Unaffected:
7.2.13 , ≤ 7.2.*
(semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "50b24a20be8c0d35f89f7d5c39533f69d84fe48e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.2.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction\n\nIt fixes both the move overflow and the eviction fence add for\nevicting these per-vm BOs."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:25:15.605Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc"
},
{
"url": "https://git.kernel.org/stable/c/50b24a20be8c0d35f89f7d5c39533f69d84fe48e"
}
],
"title": "drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99261",
"datePublished": "2026-11-03T11:25:15.605Z",
"dateReserved": "2026-09-25T10:25:14.404Z",
"dateUpdated": "2026-11-03T11:25:15.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99260 (GCVE-0-2026-99260)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:25 – Updated: 2026-11-03 11:25
VLAI
EPSS
VEX
Title
ntfs: fix resident conversion in ntfs_new_attr_flags
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix resident conversion in ntfs_new_attr_flags
When setting sparse/compressed flags on a resident attribute, the
function skipped the resident-to-non-resident conversion and
terminated.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c5434e86d6c5324990017ea043bc821d115132c8
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7ed0028126b5a19f278183abbae2b3166d3ca9ac (git) Affected: 0 , < 7.2.13 (semver) |
|
| Linux | Linux |
Unaffected:
7.2.13 , ≤ 7.2.*
(semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/ea.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c5434e86d6c5324990017ea043bc821d115132c8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7ed0028126b5a19f278183abbae2b3166d3ca9ac",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.2.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/ea.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix resident conversion in ntfs_new_attr_flags\n\nWhen setting sparse/compressed flags on a resident attribute, the\nfunction skipped the resident-to-non-resident conversion and\nterminated."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:25:15.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c5434e86d6c5324990017ea043bc821d115132c8"
},
{
"url": "https://git.kernel.org/stable/c/7ed0028126b5a19f278183abbae2b3166d3ca9ac"
}
],
"title": "ntfs: fix resident conversion in ntfs_new_attr_flags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99260",
"datePublished": "2026-11-03T11:25:15.299Z",
"dateReserved": "2026-09-25T10:25:14.404Z",
"dateUpdated": "2026-11-03T11:25:15.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99259 (GCVE-0-2026-99259)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:25 – Updated: 2026-11-03 11:25
VLAI
EPSS
VEX
Title
soc/tegra: pmc: Fix uninitialised clock rate
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc/tegra: pmc: Fix uninitialised clock rate
For legacy 32-bit Tegra devices, the warning in the
tegra_pmc_enter_suspend_mode() function is being triggered because the
early_pmc->rate variable is never configured and hence, always 0. This
issue started occurring after updating the PMC driver to create the PMC
context dynamically which causes the 'rate' to be set in the new dynamic
context, but missed updating the rate in the early PMC context.
Fix this by initialising the early_pmc->rate variable for 32-bit Tegra
devices when the rate for the PMC context is initialised.
[treding@nvidia.com: move assignment to existing #ifdef block]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4d61f03426892b14d498e160be245edcb9dd8359 , < 43bc7d5707bbbf75e56db849b987193d6e866ec6
(git)
Affected: 4d61f03426892b14d498e160be245edcb9dd8359 , < c5c95dbdc9011a56359df4dc00be829bbcc0b036 (git) |
|
| Linux | Linux |
Affected:
7.2
Unaffected: 0 , < 7.2 (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/tegra/pmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43bc7d5707bbbf75e56db849b987193d6e866ec6",
"status": "affected",
"version": "4d61f03426892b14d498e160be245edcb9dd8359",
"versionType": "git"
},
{
"lessThan": "c5c95dbdc9011a56359df4dc00be829bbcc0b036",
"status": "affected",
"version": "4d61f03426892b14d498e160be245edcb9dd8359",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/tegra/pmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc/tegra: pmc: Fix uninitialised clock rate\n\nFor legacy 32-bit Tegra devices, the warning in the\ntegra_pmc_enter_suspend_mode() function is being triggered because the\nearly_pmc-\u003erate variable is never configured and hence, always 0. This\nissue started occurring after updating the PMC driver to create the PMC\ncontext dynamically which causes the \u0027rate\u0027 to be set in the new dynamic\ncontext, but missed updating the rate in the early PMC context.\n\nFix this by initialising the early_pmc-\u003erate variable for 32-bit Tegra\ndevices when the rate for the PMC context is initialised.\n\n[treding@nvidia.com: move assignment to existing #ifdef block]"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:25:14.989Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43bc7d5707bbbf75e56db849b987193d6e866ec6"
},
{
"url": "https://git.kernel.org/stable/c/c5c95dbdc9011a56359df4dc00be829bbcc0b036"
}
],
"title": "soc/tegra: pmc: Fix uninitialised clock rate",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99259",
"datePublished": "2026-11-03T11:25:14.989Z",
"dateReserved": "2026-09-25T10:25:14.404Z",
"dateUpdated": "2026-11-03T11:25:14.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99258 (GCVE-0-2026-99258)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:25 – Updated: 2026-11-03 11:25
VLAI
EPSS
VEX
Title
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
hv_apicid_to_vp_index() currently uses the per-cpu hypercall input
and output pages. This function is called when running in VTL2 and
when running in an SEV-SNP CoCo VM with no paravisor. In the former
case, the output page is allocated, but in the latter case it is
not, so the hypervisor stores the output VP index in memory that has
not been allocated by the guest.
Fix this by using the input page for both input and output. The
hypercall has very small input and output, so sharing the same
page for both is straightforward. An alternative fix is to
allocate the per-cpu output page when running in an SEV-SNP CoCo
guest, but this uses significantly more memory, particularly
with larger vCPUs counts.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3d12349ade541eefde0e71bf5c4aa7aa04c52a79 , < bdba5f1b8bd0d18b1df61f769b559ed272902489
(git)
Affected: 86c48271e0d60c82665e9fd61277002391efcef7 , < 2b561786c9076a892ef8b8f416c9828bc87ed44f (git) Affected: 86c48271e0d60c82665e9fd61277002391efcef7 , < bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9 (git) Affected: 86c48271e0d60c82665e9fd61277002391efcef7 , < 7b74c117e2aac78e0f723e1c9c3644451c56b0d9 (git) Affected: cb002d6c8f06d6061e84b2109cb84416107a9fb9 (git) Affected: 6.12.41 , < 6.12.115 (semver) Affected: 6.15.3 , < 6.16 (semver) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/hyperv/hv_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bdba5f1b8bd0d18b1df61f769b559ed272902489",
"status": "affected",
"version": "3d12349ade541eefde0e71bf5c4aa7aa04c52a79",
"versionType": "git"
},
{
"lessThan": "2b561786c9076a892ef8b8f416c9828bc87ed44f",
"status": "affected",
"version": "86c48271e0d60c82665e9fd61277002391efcef7",
"versionType": "git"
},
{
"lessThan": "bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9",
"status": "affected",
"version": "86c48271e0d60c82665e9fd61277002391efcef7",
"versionType": "git"
},
{
"lessThan": "7b74c117e2aac78e0f723e1c9c3644451c56b0d9",
"status": "affected",
"version": "86c48271e0d60c82665e9fd61277002391efcef7",
"versionType": "git"
},
{
"status": "affected",
"version": "cb002d6c8f06d6061e84b2109cb84416107a9fb9",
"versionType": "git"
},
{
"lessThan": "6.12.115",
"status": "affected",
"version": "6.12.41",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/hyperv/hv_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.12.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()\n\nhv_apicid_to_vp_index() currently uses the per-cpu hypercall input\nand output pages. This function is called when running in VTL2 and\nwhen running in an SEV-SNP CoCo VM with no paravisor. In the former\ncase, the output page is allocated, but in the latter case it is\nnot, so the hypervisor stores the output VP index in memory that has\nnot been allocated by the guest.\n\nFix this by using the input page for both input and output. The\nhypercall has very small input and output, so sharing the same\npage for both is straightforward. An alternative fix is to\nallocate the per-cpu output page when running in an SEV-SNP CoCo\nguest, but this uses significantly more memory, particularly\nwith larger vCPUs counts."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:25:14.680Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bdba5f1b8bd0d18b1df61f769b559ed272902489"
},
{
"url": "https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f"
},
{
"url": "https://git.kernel.org/stable/c/bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9"
},
{
"url": "https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9"
}
],
"title": "x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99258",
"datePublished": "2026-11-03T11:25:14.680Z",
"dateReserved": "2026-09-25T10:25:14.404Z",
"dateUpdated": "2026-11-03T11:25:14.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99257 (GCVE-0-2026-99257)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:25 – Updated: 2026-11-03 11:25
VLAI
EPSS
VEX
Title
gpio: shared: gracefully handle no-device lookup of shared GPIOs
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: shared: gracefully handle no-device lookup of shared GPIOs
We use platform lookup tables for shared GPIOs. This mechanism needs a
struct device to work so fwnode-based lookup with no device associated
currently causes a NULL-pointer deference.
Adding this functionality will require a larger rework and it has never
worked anyway so add a check that allows the kernel to gracefully handle
this situation with an error ahead of implementing that functionality as
a new feature.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a060b8c511abb0997381b397e52149a5e3e5259a , < 7f9eb6aaf9a3ab7fa2b7dcc38660c27db12d4ec1
(git)
Affected: a060b8c511abb0997381b397e52149a5e3e5259a , < cf73c3fc03c43a8a86fd487c62390b4744eff9ec (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpiolib-shared.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7f9eb6aaf9a3ab7fa2b7dcc38660c27db12d4ec1",
"status": "affected",
"version": "a060b8c511abb0997381b397e52149a5e3e5259a",
"versionType": "git"
},
{
"lessThan": "cf73c3fc03c43a8a86fd487c62390b4744eff9ec",
"status": "affected",
"version": "a060b8c511abb0997381b397e52149a5e3e5259a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpiolib-shared.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: shared: gracefully handle no-device lookup of shared GPIOs\n\nWe use platform lookup tables for shared GPIOs. This mechanism needs a\nstruct device to work so fwnode-based lookup with no device associated\ncurrently causes a NULL-pointer deference.\n\nAdding this functionality will require a larger rework and it has never\nworked anyway so add a check that allows the kernel to gracefully handle\nthis situation with an error ahead of implementing that functionality as\na new feature."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:25:14.374Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7f9eb6aaf9a3ab7fa2b7dcc38660c27db12d4ec1"
},
{
"url": "https://git.kernel.org/stable/c/cf73c3fc03c43a8a86fd487c62390b4744eff9ec"
}
],
"title": "gpio: shared: gracefully handle no-device lookup of shared GPIOs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99257",
"datePublished": "2026-11-03T11:25:14.374Z",
"dateReserved": "2026-09-25T10:25:14.404Z",
"dateUpdated": "2026-11-03T11:25:14.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99256 (GCVE-0-2026-99256)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:25 – Updated: 2026-11-03 11:25
VLAI
EPSS
VEX
Title
dm cache: fix issue with background work locking
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix issue with background work locking
dm cache used a rw_semaphore for background_work_lock. Write locks on
rw_semaphores have strict owner semantics, but there was no guarantee
that the process that locked background_work_lock was the same process
that unlocked it. This can be easily seen using a kernel compiled with
CONFIG_DEBUG_RWSEMS. Given a dm cache device <cache>, run: 'dmsetup
suspend <cache> && dmsetup resume <cache>'. This will trigger a kernel
warning:
DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))
triggered by cache_resume(). To fix this, switch from a rw_semaphore to
a spinlock and a wait queue. dm cache already has a wait queue and
associated counter, migration_wait and nr_allocated_migrations, that was
getting woken up when background work was getting completed, but wasn't
actually used by anything. This is replaced by the background_work queue
and counter.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 0c7a8cad7c96012a9157a189649e569d0390f384
(git)
Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < f5db935d257023c3ef410bd39163b949b0e5a55d (git) Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 6290507ecc0dd6dd40759729cbbbd49b1d2a63c4 (git) Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 8433fd005c25fd127021f67c9144a879fb585572 (git) Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 2f2cfa16dd0f4179bb988139dd37d00a42324f6c (git) Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 73df2ff409f3db95029982fe3656329568e3715d (git) Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < 104f09e02038b0fc6bbb718b3976af029e15c1d0 (git) Affected: b29d4986d0da1a27cd35917cdb433672f5c95d7f , < bc9781c0247de107876f32929f1637db93a42b34 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.273 , ≤ 5.10.* (semver) Unaffected: 5.15.224 , ≤ 5.15.* (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c7a8cad7c96012a9157a189649e569d0390f384",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "f5db935d257023c3ef410bd39163b949b0e5a55d",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "6290507ecc0dd6dd40759729cbbbd49b1d2a63c4",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "8433fd005c25fd127021f67c9144a879fb585572",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "2f2cfa16dd0f4179bb988139dd37d00a42324f6c",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "73df2ff409f3db95029982fe3656329568e3715d",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "104f09e02038b0fc6bbb718b3976af029e15c1d0",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "bc9781c0247de107876f32929f1637db93a42b34",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix issue with background work locking\n\ndm cache used a rw_semaphore for background_work_lock. Write locks on\nrw_semaphores have strict owner semantics, but there was no guarantee\nthat the process that locked background_work_lock was the same process\nthat unlocked it. This can be easily seen using a kernel compiled with\nCONFIG_DEBUG_RWSEMS. Given a dm cache device \u003ccache\u003e, run: \u0027dmsetup\nsuspend \u003ccache\u003e \u0026\u0026 dmsetup resume \u003ccache\u003e\u0027. This will trigger a kernel\nwarning:\n\nDEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) \u0026\u0026 !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))\n\ntriggered by cache_resume(). To fix this, switch from a rw_semaphore to\na spinlock and a wait queue. dm cache already has a wait queue and\nassociated counter, migration_wait and nr_allocated_migrations, that was\ngetting woken up when background work was getting completed, but wasn\u0027t\nactually used by anything. This is replaced by the background_work queue\nand counter."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:25:14.077Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c7a8cad7c96012a9157a189649e569d0390f384"
},
{
"url": "https://git.kernel.org/stable/c/f5db935d257023c3ef410bd39163b949b0e5a55d"
},
{
"url": "https://git.kernel.org/stable/c/6290507ecc0dd6dd40759729cbbbd49b1d2a63c4"
},
{
"url": "https://git.kernel.org/stable/c/8433fd005c25fd127021f67c9144a879fb585572"
},
{
"url": "https://git.kernel.org/stable/c/2f2cfa16dd0f4179bb988139dd37d00a42324f6c"
},
{
"url": "https://git.kernel.org/stable/c/73df2ff409f3db95029982fe3656329568e3715d"
},
{
"url": "https://git.kernel.org/stable/c/104f09e02038b0fc6bbb718b3976af029e15c1d0"
},
{
"url": "https://git.kernel.org/stable/c/bc9781c0247de107876f32929f1637db93a42b34"
}
],
"title": "dm cache: fix issue with background work locking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99256",
"datePublished": "2026-11-03T11:25:14.077Z",
"dateReserved": "2026-09-25T10:25:14.404Z",
"dateUpdated": "2026-11-03T11:25:14.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99255 (GCVE-0-2026-99255)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:20 – Updated: 2026-11-03 11:20
VLAI
EPSS
VEX
Title
io_uring/io-wq: don't hide a link from cancellations
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/io-wq: don't hide a link from cancellations
A task that exits cancels its tracked requests and waits until they are
gone. io_uring_cancel_generic() looks everywhere a request can be, and
goes to sleep if it found nothing to cancel. It is woken up each time
one of the requests of the task is completed by task work or freed.
When io-wq is done with a request that has a link, there is a time in which
the next request of the link can't be found:
io_worker_handle_work()
io_assign_current_work(worker, NULL)
io_wq_free_work(work)
io_req_find_next() // takes the link off the request
io_free_req() // task work for the task
io_assign_current_work(worker, linked)
io_run_task_work()
cond_resched()
worker->cur_work = linked
It is not pending, it is not the current work of a worker, and it is not
yet on the list that it is about to be parked on. If the pass that the
exiting task makes because of io_free_req() falls into that time, it finds
nothing and the task goes to sleep. The worker then runs the link, which
IO_WQ_BIT_EXIT doesn't prevent for bounded work. If that parks the request
nothing is completed or freed, and nobody wakes up the task. If it is the
process that exits it can't be killed any more either.
NOP, IOSQE_ASYNC | IOSQE_IO_LINK
FUTEX_WAIT, FUTEX2_PRIVATE
exit of the thread, or of the process, up to 63us later
With four of these per round 5 to 8 of 10,000 rounds hang (4 CPUs, KVM):
io_uring_cancel_generic
do_exit
Commit f8b632e89a10 ("io_uring: tighten task exit cancellations") is about
the same gap, and makes the task look again for whatever happens before
io_free_req().
Free the request once the link is the current work of the worker, or
pending. Whoever is woken up by that can find the link, until it is parked
where cancellations look as well. To do so split io_wq_free_work() in two.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
768134d4f48109b90f4248feecbeeb7d684e410c , < 98470f164286f7f62aaee519d4d11b9370ce6d7b
(git)
Affected: 768134d4f48109b90f4248feecbeeb7d684e410c , < d39ebc7a583d650b1d6da9b45e2ce96ad4d877e4 (git) Affected: 768134d4f48109b90f4248feecbeeb7d684e410c , < ebe8e97fb99d9f374c482902a00677cfd24a6c27 (git) Affected: 768134d4f48109b90f4248feecbeeb7d684e410c , < 3e02b8df0e9fa1423ac2a4e03409a9329c30ac49 (git) Affected: 768134d4f48109b90f4248feecbeeb7d684e410c , < 92e20e9c72bdf6cfa6f84eded7b33399bc7061da (git) |
|
| Linux | Linux |
Affected:
5.5
Unaffected: 0 , < 5.5 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.60 , ≤ 6.18.* (semver) Unaffected: 7.2.14 , ≤ 7.2.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/io-wq.c",
"io_uring/io_uring.c",
"io_uring/io_uring.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98470f164286f7f62aaee519d4d11b9370ce6d7b",
"status": "affected",
"version": "768134d4f48109b90f4248feecbeeb7d684e410c",
"versionType": "git"
},
{
"lessThan": "d39ebc7a583d650b1d6da9b45e2ce96ad4d877e4",
"status": "affected",
"version": "768134d4f48109b90f4248feecbeeb7d684e410c",
"versionType": "git"
},
{
"lessThan": "ebe8e97fb99d9f374c482902a00677cfd24a6c27",
"status": "affected",
"version": "768134d4f48109b90f4248feecbeeb7d684e410c",
"versionType": "git"
},
{
"lessThan": "3e02b8df0e9fa1423ac2a4e03409a9329c30ac49",
"status": "affected",
"version": "768134d4f48109b90f4248feecbeeb7d684e410c",
"versionType": "git"
},
{
"lessThan": "92e20e9c72bdf6cfa6f84eded7b33399bc7061da",
"status": "affected",
"version": "768134d4f48109b90f4248feecbeeb7d684e410c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/io-wq.c",
"io_uring/io_uring.c",
"io_uring/io_uring.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don\u0027t hide a link from cancellations\n\nA task that exits cancels its tracked requests and waits until they are\ngone. io_uring_cancel_generic() looks everywhere a request can be, and\ngoes to sleep if it found nothing to cancel. It is woken up each time\none of the requests of the task is completed by task work or freed.\n\nWhen io-wq is done with a request that has a link, there is a time in which\nthe next request of the link can\u0027t be found:\n\n io_worker_handle_work()\n io_assign_current_work(worker, NULL)\n io_wq_free_work(work)\n io_req_find_next() // takes the link off the request\n io_free_req() // task work for the task\n io_assign_current_work(worker, linked)\n io_run_task_work()\n cond_resched()\n worker-\u003ecur_work = linked\n\nIt is not pending, it is not the current work of a worker, and it is not\nyet on the list that it is about to be parked on. If the pass that the\nexiting task makes because of io_free_req() falls into that time, it finds\nnothing and the task goes to sleep. The worker then runs the link, which\nIO_WQ_BIT_EXIT doesn\u0027t prevent for bounded work. If that parks the request\nnothing is completed or freed, and nobody wakes up the task. If it is the\nprocess that exits it can\u0027t be killed any more either.\n\n NOP, IOSQE_ASYNC | IOSQE_IO_LINK\n FUTEX_WAIT, FUTEX2_PRIVATE\n exit of the thread, or of the process, up to 63us later\n\nWith four of these per round 5 to 8 of 10,000 rounds hang (4 CPUs, KVM):\n\n io_uring_cancel_generic\n do_exit\n\nCommit f8b632e89a10 (\"io_uring: tighten task exit cancellations\") is about\nthe same gap, and makes the task look again for whatever happens before\nio_free_req().\n\nFree the request once the link is the current work of the worker, or\npending. Whoever is woken up by that can find the link, until it is parked\nwhere cancellations look as well. To do so split io_wq_free_work() in two."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:20:13.169Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98470f164286f7f62aaee519d4d11b9370ce6d7b"
},
{
"url": "https://git.kernel.org/stable/c/d39ebc7a583d650b1d6da9b45e2ce96ad4d877e4"
},
{
"url": "https://git.kernel.org/stable/c/ebe8e97fb99d9f374c482902a00677cfd24a6c27"
},
{
"url": "https://git.kernel.org/stable/c/3e02b8df0e9fa1423ac2a4e03409a9329c30ac49"
},
{
"url": "https://git.kernel.org/stable/c/92e20e9c72bdf6cfa6f84eded7b33399bc7061da"
}
],
"title": "io_uring/io-wq: don\u0027t hide a link from cancellations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99255",
"datePublished": "2026-11-03T11:20:13.169Z",
"dateReserved": "2026-09-25T10:25:14.404Z",
"dateUpdated": "2026-11-03T11:20:13.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99254 (GCVE-0-2026-99254)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:20 – Updated: 2026-11-03 11:20
VLAI
EPSS
VEX
Title
io_uring: don't flood a cancelling task with task_work
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring: don't flood a cancelling task with task_work
io_ring_exit_work() asks each task which has used the ring to remove its
tctx node, by task_work, and repeats that until the list is empty.
io_tctx_exit_cb() doesn't touch the node while the task is in
io_uring_cancel_generic(), which removes all the nodes at its end. So the
work item queues the callback again as soon as it has completed, for
nothing.
That is more than a waste of time. task_work_run() only returns when it
finds the list empty. If the rings are released from inside the
cancellation, because requests of other rings held the last references to
their files, up to 64 work items keep sending callbacks to the one task
which is running them. It never finds the list empty, never gets back to
the cancellation, the nodes stay, and so it goes on: a task with 60 pairs
of rings which poll each other ran 280000 callbacks in 5 seconds, 20
seconds after exit_group(). It ends when all the senders happen to be late
at the same time. Until then the task keeps a CPU and the work items busy.
An exiting task can't be killed meanwhile. execve() cancels the requests in
the same way, so a live task can get stuck there as well, for minutes. If
it takes more than five, the work items run into the
WARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No
privilege is needed for any of this.
If the callback has met a task in cancellation, wait a little before it is
sent again. Nobody has to wake the work item up for that: either the node
is gone by then, or it is the turn of the next round.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d56d938b4bef3e1421a42023cdcd6e13c1f50831 , < a22fb44e988b01b82235ea07f0bf0fc73e256596
(git)
Affected: d56d938b4bef3e1421a42023cdcd6e13c1f50831 , < 2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1 (git) Affected: d56d938b4bef3e1421a42023cdcd6e13c1f50831 , < 61c761fc21e00e45c33c2bb596be442d92fb8792 (git) Affected: d56d938b4bef3e1421a42023cdcd6e13c1f50831 , < 14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9 (git) Affected: d56d938b4bef3e1421a42023cdcd6e13c1f50831 , < abdc57c7ebabaaf0b622178a6a85834e1e54ff80 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.60 , ≤ 6.18.* (semver) Unaffected: 7.2.14 , ≤ 7.2.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/io_uring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a22fb44e988b01b82235ea07f0bf0fc73e256596",
"status": "affected",
"version": "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
"versionType": "git"
},
{
"lessThan": "2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1",
"status": "affected",
"version": "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
"versionType": "git"
},
{
"lessThan": "61c761fc21e00e45c33c2bb596be442d92fb8792",
"status": "affected",
"version": "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
"versionType": "git"
},
{
"lessThan": "14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9",
"status": "affected",
"version": "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
"versionType": "git"
},
{
"lessThan": "abdc57c7ebabaaf0b622178a6a85834e1e54ff80",
"status": "affected",
"version": "d56d938b4bef3e1421a42023cdcd6e13c1f50831",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/io_uring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: don\u0027t flood a cancelling task with task_work\n\nio_ring_exit_work() asks each task which has used the ring to remove its\ntctx node, by task_work, and repeats that until the list is empty.\nio_tctx_exit_cb() doesn\u0027t touch the node while the task is in\nio_uring_cancel_generic(), which removes all the nodes at its end. So the\nwork item queues the callback again as soon as it has completed, for\nnothing.\n\nThat is more than a waste of time. task_work_run() only returns when it\nfinds the list empty. If the rings are released from inside the\ncancellation, because requests of other rings held the last references to\ntheir files, up to 64 work items keep sending callbacks to the one task\nwhich is running them. It never finds the list empty, never gets back to\nthe cancellation, the nodes stay, and so it goes on: a task with 60 pairs\nof rings which poll each other ran 280000 callbacks in 5 seconds, 20\nseconds after exit_group(). It ends when all the senders happen to be late\nat the same time. Until then the task keeps a CPU and the work items busy.\n\nAn exiting task can\u0027t be killed meanwhile. execve() cancels the requests in\nthe same way, so a live task can get stuck there as well, for minutes. If\nit takes more than five, the work items run into the\nWARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No\nprivilege is needed for any of this.\n\nIf the callback has met a task in cancellation, wait a little before it is\nsent again. Nobody has to wake the work item up for that: either the node\nis gone by then, or it is the turn of the next round."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:20:12.802Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a22fb44e988b01b82235ea07f0bf0fc73e256596"
},
{
"url": "https://git.kernel.org/stable/c/2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1"
},
{
"url": "https://git.kernel.org/stable/c/61c761fc21e00e45c33c2bb596be442d92fb8792"
},
{
"url": "https://git.kernel.org/stable/c/14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9"
},
{
"url": "https://git.kernel.org/stable/c/abdc57c7ebabaaf0b622178a6a85834e1e54ff80"
}
],
"title": "io_uring: don\u0027t flood a cancelling task with task_work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99254",
"datePublished": "2026-11-03T11:20:12.802Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:20:12.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99253 (GCVE-0-2026-99253)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:20 – Updated: 2026-11-03 11:20
VLAI
EPSS
VEX
Title
io_uring/cancel: rearm local work wake up before sleep
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/cancel: rearm local work wake up before sleep
io_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next
io_req_local_work_add() wakes the cancelling task. The add that takes the
count to zero is the only one that wakes, later ones see a count <= 0 and
return. io_uring_cancel_generic() however only becomes
TASK_INTERRUPTIBLE much later, so the one wake up can be spent on a
running task. That is fine as long as the entry of that add is still
queued, as the io_local_work_pending() check then skips the sleep. It is
not if the add was delayed after queueing its entry:
CPU0 (submitter in exec or exit) CPU1 (io_req_local_work_add)
mpscq_push(req A)
io_uring_try_cancel_requests()
io_run_local_work() // runs req A
io_uring_try_cancel_requests()
atomic_set(&ctx->cq_wait_nr, 1)
atomic_read(&ctx->cq_wait_nr) == 1
count taken, wake_up_state()
// task is running, no-op
prepare_to_wait(TASK_INTERRUPTIBLE)
io_local_work_pending() == false
schedule()
mpscq_push(req B)
cq_wait_nr <= 0, return
Only the sleeping task can run req B, so it is stuck in execve() until a
signal happens to wake it. An exiting task doesn't even get that.
Arm the count again once the task state is set and before the work list
is checked, for the rings whose local work this task is the one to run.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/cancel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2",
"status": "affected",
"version": "d46ab2c98ababa19b41a5709b6921d7b1add7f74",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/cancel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: rearm local work wake up before sleep\n\nio_uring_try_cancel_requests() sets -\u003ecq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count \u003c= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\n\nCPU0 (submitter in exec or exit) CPU1 (io_req_local_work_add)\n mpscq_push(req A)\nio_uring_try_cancel_requests()\n io_run_local_work() // runs req A\nio_uring_try_cancel_requests()\n atomic_set(\u0026ctx-\u003ecq_wait_nr, 1)\n atomic_read(\u0026ctx-\u003ecq_wait_nr) == 1\n count taken, wake_up_state()\n // task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\n mpscq_push(req B)\n cq_wait_nr \u003c= 0, return\n\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn\u0027t even get that.\n\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:20:12.490Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2"
}
],
"title": "io_uring/cancel: rearm local work wake up before sleep",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99253",
"datePublished": "2026-11-03T11:20:12.490Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:20:12.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99252 (GCVE-0-2026-99252)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:20 – Updated: 2026-11-03 11:20
VLAI
EPSS
VEX
Title
io_uring/mpscq: disable preemption while pushing
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/mpscq: disable preemption while pushing
A push makes the node the new tail, and then links it to its predecessor.
In between the queue isn't empty, but mpscq_pop() can't get at the node.
The consumers deal with that by trying again, with a cond_resched() in
the loop to give a preempted producer the chance to finish.
cond_resched() doesn't do that if the consumer has a higher priority than
the producer and both have to use the same CPU:
producer (SCHED_OTHER) consumer (SCHED_FIFO), same CPU
io_req_local_work_add()
mpscq_push()
prev = xchg(&q->tail, node)
<preempted> io_cqring_wait()
__io_run_local_work()
again:
cond_resched() // nothing to do
mpscq_pop() // NULL
// work pending, no events yet
goto again
The producer can be any task that is able to queue task_work for the
ring: an io-wq worker, or somebody who sends a message with
IORING_OP_MSG_RING. The consumer spins, holding ->uring_lock, until the
scheduler takes pity on the fair class, which takes about a second with
the default settings of the fair server, and forever without it. The
loops in tctx_task_work_run() and io_cancel_local_task_work() have the
same problem.
Don't allow preemption between the two steps. That bounds the time the
window is open on the CPU of the producer by what interrupts take, and a
consumer that waits for that is on another CPU. The cost is a
preempt_disable()/preempt_enable() pair per push.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/mpscq.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c94677e2b6145393d4c129fe0f5364b0e5000a5",
"status": "affected",
"version": "50cb44bd0d5f243919a06b17b1d979fdcd72cb2b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/mpscq.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/mpscq: disable preemption while pushing\n\nA push makes the node the new tail, and then links it to its predecessor.\nIn between the queue isn\u0027t empty, but mpscq_pop() can\u0027t get at the node.\nThe consumers deal with that by trying again, with a cond_resched() in\nthe loop to give a preempted producer the chance to finish.\n\ncond_resched() doesn\u0027t do that if the consumer has a higher priority than\nthe producer and both have to use the same CPU:\n\n producer (SCHED_OTHER) consumer (SCHED_FIFO), same CPU\n io_req_local_work_add()\n mpscq_push()\n prev = xchg(\u0026q-\u003etail, node)\n \u003cpreempted\u003e io_cqring_wait()\n __io_run_local_work()\n again:\n cond_resched() // nothing to do\n mpscq_pop() // NULL\n // work pending, no events yet\n goto again\n\nThe producer can be any task that is able to queue task_work for the\nring: an io-wq worker, or somebody who sends a message with\nIORING_OP_MSG_RING. The consumer spins, holding -\u003euring_lock, until the\nscheduler takes pity on the fair class, which takes about a second with\nthe default settings of the fair server, and forever without it. The\nloops in tctx_task_work_run() and io_cancel_local_task_work() have the\nsame problem.\n\nDon\u0027t allow preemption between the two steps. That bounds the time the\nwindow is open on the CPU of the producer by what interrupts take, and a\nconsumer that waits for that is on another CPU. The cost is a\npreempt_disable()/preempt_enable() pair per push."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:20:12.192Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c94677e2b6145393d4c129fe0f5364b0e5000a5"
}
],
"title": "io_uring/mpscq: disable preemption while pushing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99252",
"datePublished": "2026-11-03T11:20:12.192Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:20:12.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99251 (GCVE-0-2026-99251)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:18 – Updated: 2026-11-03 11:18
VLAI
EPSS
VEX
Title
Drivers: hv: Avoid infinite retry loop in init_vp_index()
Summary
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Avoid infinite retry loop in init_vp_index()
There is a retry loop in init_vp_index() where the CPUs from a certain
node are stripped out if they have already been in the allocated cpumask
or not in HK_TYPE_MANAGED_IRQ housekeeping cpumask. If there is no
CPU left, the allocated cpumask is ignored and the process is retried
again. However, if the HK_TYPE_MANAGED_IRQ housekeeping cpumask turns
out not to contain any CPU in that particular node, that will become an
infinite retry loop. This particular problem was reported by sashiko
[1]. This should rarely happen, but we still need to guard against this.
Fix this infinite loop problem by also skipping NUMA node that has no
housekeeping CPU in the inner while loop of init_vp_index(). Also update
the early abort check to check for the absence of online housekeeping
CPUs instead of just the emptiness of the cpumask. As the outer for
loop will only be reached if the housekeeping cpumask has at least one
online CPU, a NUMA node with housekeeping CPUs will eventually be found.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6640b5df1a38801be6d0595c8cd2177d968d7ee0 , < b3993f6dc106ff416c7a613c631e1e0af451aed7
(git)
Affected: 6640b5df1a38801be6d0595c8cd2177d968d7ee0 , < f561392afb44a8a42c54c1cfd3f33dace0b50537 (git) Affected: 6640b5df1a38801be6d0595c8cd2177d968d7ee0 , < 15dd3429f0e76ca071657e480cb7e6ff3a1af730 (git) Affected: 6640b5df1a38801be6d0595c8cd2177d968d7ee0 , < 7141331f2d245efc07175802a6bf76badec871ed (git) Affected: 6640b5df1a38801be6d0595c8cd2177d968d7ee0 , < 95fec47cdbf747b81ab22affd7252dda6050ad0c (git) Affected: 6640b5df1a38801be6d0595c8cd2177d968d7ee0 , < 32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hv/channel_mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3993f6dc106ff416c7a613c631e1e0af451aed7",
"status": "affected",
"version": "6640b5df1a38801be6d0595c8cd2177d968d7ee0",
"versionType": "git"
},
{
"lessThan": "f561392afb44a8a42c54c1cfd3f33dace0b50537",
"status": "affected",
"version": "6640b5df1a38801be6d0595c8cd2177d968d7ee0",
"versionType": "git"
},
{
"lessThan": "15dd3429f0e76ca071657e480cb7e6ff3a1af730",
"status": "affected",
"version": "6640b5df1a38801be6d0595c8cd2177d968d7ee0",
"versionType": "git"
},
{
"lessThan": "7141331f2d245efc07175802a6bf76badec871ed",
"status": "affected",
"version": "6640b5df1a38801be6d0595c8cd2177d968d7ee0",
"versionType": "git"
},
{
"lessThan": "95fec47cdbf747b81ab22affd7252dda6050ad0c",
"status": "affected",
"version": "6640b5df1a38801be6d0595c8cd2177d968d7ee0",
"versionType": "git"
},
{
"lessThan": "32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd",
"status": "affected",
"version": "6640b5df1a38801be6d0595c8cd2177d968d7ee0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hv/channel_mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Avoid infinite retry loop in init_vp_index()\n\nThere is a retry loop in init_vp_index() where the CPUs from a certain\nnode are stripped out if they have already been in the allocated cpumask\nor not in HK_TYPE_MANAGED_IRQ housekeeping cpumask. If there is no\nCPU left, the allocated cpumask is ignored and the process is retried\nagain. However, if the HK_TYPE_MANAGED_IRQ housekeeping cpumask turns\nout not to contain any CPU in that particular node, that will become an\ninfinite retry loop. This particular problem was reported by sashiko\n[1]. This should rarely happen, but we still need to guard against this.\n\nFix this infinite loop problem by also skipping NUMA node that has no\nhousekeeping CPU in the inner while loop of init_vp_index(). Also update\nthe early abort check to check for the absence of online housekeeping\nCPUs instead of just the emptiness of the cpumask. As the outer for\nloop will only be reached if the housekeeping cpumask has at least one\nonline CPU, a NUMA node with housekeeping CPUs will eventually be found."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:18:27.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3993f6dc106ff416c7a613c631e1e0af451aed7"
},
{
"url": "https://git.kernel.org/stable/c/f561392afb44a8a42c54c1cfd3f33dace0b50537"
},
{
"url": "https://git.kernel.org/stable/c/15dd3429f0e76ca071657e480cb7e6ff3a1af730"
},
{
"url": "https://git.kernel.org/stable/c/7141331f2d245efc07175802a6bf76badec871ed"
},
{
"url": "https://git.kernel.org/stable/c/95fec47cdbf747b81ab22affd7252dda6050ad0c"
},
{
"url": "https://git.kernel.org/stable/c/32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd"
}
],
"title": "Drivers: hv: Avoid infinite retry loop in init_vp_index()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99251",
"datePublished": "2026-11-03T11:18:27.412Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:18:27.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99250 (GCVE-0-2026-99250)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:18 – Updated: 2026-11-03 11:18
VLAI
EPSS
VEX
Title
printk: Postpone kthread startup
Summary
In the Linux kernel, the following vulnerability has been resolved:
printk: Postpone kthread startup
There have been various bug reports related to SMP systems hanging
on boot. The reports vary but seem to have some overlap with regard
to missed IPI's during SMP setup. The reports also show that
reverting NBCON console usage allows the bugs to disappear.
The NBCON kthreads for console printing are started very early
during boot using early_initcall(). Since these kthreads are
asynchronously enabling/disabling interrupts during early boot, they
may be interfering with early SMP setup on some hardware platforms.
Starting the console printing kthreads later has shown to avoid the
hanging on systems that could previously reproduce the issue.
Postpone kthread starting until after all arch initcalls have
completed.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
76f258bf3f2aae570209319944703a92ac64e29e , < a86bcdd84c8fe7a45f73e12d53fe06fea07d1ceb
(git)
Affected: 76f258bf3f2aae570209319944703a92ac64e29e , < 7595bacee48bc30b5021eccf199d704d4e5e5374 (git) Affected: 76f258bf3f2aae570209319944703a92ac64e29e , < 792acd173da0884f0172c68cb473f42cf93c647e (git) Affected: 76f258bf3f2aae570209319944703a92ac64e29e , < 5f339c46f153184570f16c8e789c9709b14cbe8b (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/printk/printk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a86bcdd84c8fe7a45f73e12d53fe06fea07d1ceb",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
},
{
"lessThan": "7595bacee48bc30b5021eccf199d704d4e5e5374",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
},
{
"lessThan": "792acd173da0884f0172c68cb473f42cf93c647e",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
},
{
"lessThan": "5f339c46f153184570f16c8e789c9709b14cbe8b",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/printk/printk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Postpone kthread startup\n\nThere have been various bug reports related to SMP systems hanging\non boot. The reports vary but seem to have some overlap with regard\nto missed IPI\u0027s during SMP setup. The reports also show that\nreverting NBCON console usage allows the bugs to disappear.\n\nThe NBCON kthreads for console printing are started very early\nduring boot using early_initcall(). Since these kthreads are\nasynchronously enabling/disabling interrupts during early boot, they\nmay be interfering with early SMP setup on some hardware platforms.\n\nStarting the console printing kthreads later has shown to avoid the\nhanging on systems that could previously reproduce the issue.\n\nPostpone kthread starting until after all arch initcalls have\ncompleted."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:18:27.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a86bcdd84c8fe7a45f73e12d53fe06fea07d1ceb"
},
{
"url": "https://git.kernel.org/stable/c/7595bacee48bc30b5021eccf199d704d4e5e5374"
},
{
"url": "https://git.kernel.org/stable/c/792acd173da0884f0172c68cb473f42cf93c647e"
},
{
"url": "https://git.kernel.org/stable/c/5f339c46f153184570f16c8e789c9709b14cbe8b"
}
],
"title": "printk: Postpone kthread startup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99250",
"datePublished": "2026-11-03T11:18:27.105Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:18:27.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99249 (GCVE-0-2026-99249)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:18 – Updated: 2026-11-03 11:18
VLAI
EPSS
VEX
Title
pid_namespace: make zap_pid_ns_processes() freezable
Summary
In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: make zap_pid_ns_processes() freezable
When the init of a pid namespace exits, zap_pid_ns_processes() waits
until all other pids in the namespace are freed. A tracer outside the
namespace that does not reap its traced zombies keeps those pids
allocated, so this wait has no upper bound, and while it lasts every
suspend attempt fails:
Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):
Neither wait is freezable. The first loop sleeps in do_wait(), which
returns -ERESTARTSYS on the freezer's fake signal; the loop then clears
TIF_SIGPENDING and waits again without ever freezing. The final loop
sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING
there, schedule() returns immediately after the first freeze attempt
and the task spins until the wait ends.
Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the
freezer can freeze tasks waiting there directly, and in TASK_IDLE |
TASK_FREEZABLE in the final loop, like coredump_task_exit() does.
This was hit with Chromium-based browsers: crashpad ptrace-attaches the
threads of a crashed renderer, which is a pid namespace init, and does
not reap those killed during the dump.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3eb07c8c8adb6f0572baba844ba2d9e501654316 , < 064a6761d6f6ac55d090d3eaca649577ee736713
(git)
Affected: 3eb07c8c8adb6f0572baba844ba2d9e501654316 , < e8dafad7de9ede813af2d48cc04b7c88fef16682 (git) Affected: 3eb07c8c8adb6f0572baba844ba2d9e501654316 , < 4b47107f1a80c809c80093e872bcaccdbae13db4 (git) Affected: 3eb07c8c8adb6f0572baba844ba2d9e501654316 , < 2e10b8a74f55b5aae33db105d3e2d3ae759c865a (git) Affected: 3eb07c8c8adb6f0572baba844ba2d9e501654316 , < 7deb5770840339fe88755bf27b92f74edc26ee87 (git) Affected: 3eb07c8c8adb6f0572baba844ba2d9e501654316 , < 81933038f5e273d17ed22792f906889393b204c5 (git) |
|
| Linux | Linux |
Affected:
2.6.24
Unaffected: 0 , < 2.6.24 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/exit.c",
"kernel/pid_namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "064a6761d6f6ac55d090d3eaca649577ee736713",
"status": "affected",
"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316",
"versionType": "git"
},
{
"lessThan": "e8dafad7de9ede813af2d48cc04b7c88fef16682",
"status": "affected",
"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316",
"versionType": "git"
},
{
"lessThan": "4b47107f1a80c809c80093e872bcaccdbae13db4",
"status": "affected",
"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316",
"versionType": "git"
},
{
"lessThan": "2e10b8a74f55b5aae33db105d3e2d3ae759c865a",
"status": "affected",
"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316",
"versionType": "git"
},
{
"lessThan": "7deb5770840339fe88755bf27b92f74edc26ee87",
"status": "affected",
"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316",
"versionType": "git"
},
{
"lessThan": "81933038f5e273d17ed22792f906889393b204c5",
"status": "affected",
"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/exit.c",
"kernel/pid_namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: make zap_pid_ns_processes() freezable\n\nWhen the init of a pid namespace exits, zap_pid_ns_processes() waits\nuntil all other pids in the namespace are freed. A tracer outside the\nnamespace that does not reap its traced zombies keeps those pids\nallocated, so this wait has no upper bound, and while it lasts every\nsuspend attempt fails:\n\n Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):\n\nNeither wait is freezable. The first loop sleeps in do_wait(), which\nreturns -ERESTARTSYS on the freezer\u0027s fake signal; the loop then clears\nTIF_SIGPENDING and waits again without ever freezing. The final loop\nsleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING\nthere, schedule() returns immediately after the first freeze attempt\nand the task spins until the wait ends.\n\nSleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the\nfreezer can freeze tasks waiting there directly, and in TASK_IDLE |\nTASK_FREEZABLE in the final loop, like coredump_task_exit() does.\n\nThis was hit with Chromium-based browsers: crashpad ptrace-attaches the\nthreads of a crashed renderer, which is a pid namespace init, and does\nnot reap those killed during the dump."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:18:26.800Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713"
},
{
"url": "https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682"
},
{
"url": "https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4"
},
{
"url": "https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a"
},
{
"url": "https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87"
},
{
"url": "https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5"
}
],
"title": "pid_namespace: make zap_pid_ns_processes() freezable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99249",
"datePublished": "2026-11-03T11:18:26.800Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:18:26.800Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99248 (GCVE-0-2026-99248)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:18 – Updated: 2026-11-03 11:18
VLAI
EPSS
VEX
Title
i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
The devres conversion replaced manual pm_runtime_enable()/disable() with
devm_pm_runtime_set_active_enabled() and dropped the remove-time runtime
PM teardown. The managed release tears runtime PM down in the wrong
order: it calls pm_runtime_dont_use_autosuspend() before
pm_runtime_disable(), i.e. while runtime PM is still enabled, and devres
is LIFO so the devm_clk_get_enabled() release runs afterwards.
At remove(), pm_runtime_put_sync() leaves the device active with the
autosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()
suspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the
clock. The later devm_clk_get_enabled() release clk_disable_unprepare()s
the already-disabled clock, so clk_core_disable() WARNs ("clkN already
disabled") on every teardown.
Drop the managed helper and restore the non-managed runtime PM setup and
teardown, so runtime PM is enabled once in probe and disabled once in
remove and the clock enable count stays balanced.
Order the remove teardown so runtime PM is disabled before the usage
count is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()
instead of pm_runtime_put_sync(). Dropping the count first with autosuspend
still enabled arms the autosuspend timer, and a preemption before
pm_runtime_disable() lets it expire, suspend the device and clk_disable()
the clock, which the devm release then disables again - the same WARN.
Restore the non-managed IRQ request as well. The probe error paths now
unwind runtime PM by hand via goto, and a devm-registered handler is only
freed later during devres unwind, so it would stay live across the manual
teardown (and across any future failing step added after it). Request the
IRQ with request_threaded_irq() and free it explicitly in the probe error
path and in remove. The probe error path also clears use_autosuspend, to
match the teardown in remove().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
50c63491ff267f2860a6d8cb70c9a30ab701b9d3 , < 47e105bdc863f2b320f9c05c80a63d3b83312700
(git)
Affected: 50c63491ff267f2860a6d8cb70c9a30ab701b9d3 , < d33373c565af9c8a28776af02bd20ba6e5724211 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-xiic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47e105bdc863f2b320f9c05c80a63d3b83312700",
"status": "affected",
"version": "50c63491ff267f2860a6d8cb70c9a30ab701b9d3",
"versionType": "git"
},
{
"lessThan": "d33373c565af9c8a28776af02bd20ba6e5724211",
"status": "affected",
"version": "50c63491ff267f2860a6d8cb70c9a30ab701b9d3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-xiic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: xiic: restore non-managed runtime PM to fix clk WARN flood\n\nThe devres conversion replaced manual pm_runtime_enable()/disable() with\ndevm_pm_runtime_set_active_enabled() and dropped the remove-time runtime\nPM teardown. The managed release tears runtime PM down in the wrong\norder: it calls pm_runtime_dont_use_autosuspend() before\npm_runtime_disable(), i.e. while runtime PM is still enabled, and devres\nis LIFO so the devm_clk_get_enabled() release runs afterwards.\n\nAt remove(), pm_runtime_put_sync() leaves the device active with the\nautosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()\nsuspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the\nclock. The later devm_clk_get_enabled() release clk_disable_unprepare()s\nthe already-disabled clock, so clk_core_disable() WARNs (\"clkN already\ndisabled\") on every teardown.\n\nDrop the managed helper and restore the non-managed runtime PM setup and\nteardown, so runtime PM is enabled once in probe and disabled once in\nremove and the clock enable count stays balanced.\n\nOrder the remove teardown so runtime PM is disabled before the usage\ncount is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()\ninstead of pm_runtime_put_sync(). Dropping the count first with autosuspend\nstill enabled arms the autosuspend timer, and a preemption before\npm_runtime_disable() lets it expire, suspend the device and clk_disable()\nthe clock, which the devm release then disables again - the same WARN.\n\nRestore the non-managed IRQ request as well. The probe error paths now\nunwind runtime PM by hand via goto, and a devm-registered handler is only\nfreed later during devres unwind, so it would stay live across the manual\nteardown (and across any future failing step added after it). Request the\nIRQ with request_threaded_irq() and free it explicitly in the probe error\npath and in remove. The probe error path also clears use_autosuspend, to\nmatch the teardown in remove()."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:18:26.478Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47e105bdc863f2b320f9c05c80a63d3b83312700"
},
{
"url": "https://git.kernel.org/stable/c/d33373c565af9c8a28776af02bd20ba6e5724211"
}
],
"title": "i2c: xiic: restore non-managed runtime PM to fix clk WARN flood",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99248",
"datePublished": "2026-11-03T11:18:26.478Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:18:26.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99247 (GCVE-0-2026-99247)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:18 – Updated: 2026-11-03 11:18
VLAI
EPSS
VEX
Title
tracing: Do not initialize tracefs work if tracing is disabled
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Do not initialize tracefs work if tracing is disabled
If trace buffer allocation fails during early boot (e.g. in
early_trace_init() -> allocate_trace_buffers()), tracing_disabled is
left set to 1 and the global trace array events list remains
uninitialized.
Later during boot, tracer_init_tracefs() (invoked via fs_initcall)
queues tracerfs_init_work asynchronously without checking if tracing was
disabled. When tracer_init_tracefs_work_func() runs, it calls
event_trace_init() and init_tracer_tracefs(&global_trace, NULL)
unconditionally. This leads to __find_event_file() dereferencing an
uninitialized tr->events list, causing an early boot NULL pointer
dereference Oops:
BUG: Kernel NULL pointer dereference on read at 0x00000010
Faulting instruction address: 0xc000000000485be0
Oops: Kernel access of bad area, sig: 7 [#1]
...
NIP [c000000000485be0] __find_event_file+0x70/0x3c0
LR [c000000000448874] init_tracer_tracefs+0x274/0xc80
Call Trace:
init_tracer_tracefs+0x274/0xc80
tracer_init_tracefs_work_func+0x50/0x320
process_one_work+0x1e8/0x5c0
worker_thread+0x1dc/0x3d0
kthread+0x194/0x1b0
start_kernel_thread+0x14/0x18
Check tracing_disabled at the beginning of tracer_init_tracefs_work_func()
and return immediately if tracing is disabled or failed to initialize,
preventing the crash.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6621a7004684bfcff5af4c8e4d37989941f42a6b , < e8665e884e076d894f3eed8b9ea28e37a6448604
(git)
Affected: 6621a7004684bfcff5af4c8e4d37989941f42a6b , < e8cfcd7e60eaa3b0dea4d71c64499604e7081736 (git) Affected: 6621a7004684bfcff5af4c8e4d37989941f42a6b , < afd38b10b1c6a5c5d6952b15b990596dab9684e6 (git) Affected: 6621a7004684bfcff5af4c8e4d37989941f42a6b , < 813e18881c6472eb229a63180ff42c808e3e949b (git) Affected: 6621a7004684bfcff5af4c8e4d37989941f42a6b , < 7539c61f522ff693d9565a0411386c2236e776cd (git) Affected: 6621a7004684bfcff5af4c8e4d37989941f42a6b , < b3b974008388ab59e44d764ba7a63c988fec2524 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e8665e884e076d894f3eed8b9ea28e37a6448604",
"status": "affected",
"version": "6621a7004684bfcff5af4c8e4d37989941f42a6b",
"versionType": "git"
},
{
"lessThan": "e8cfcd7e60eaa3b0dea4d71c64499604e7081736",
"status": "affected",
"version": "6621a7004684bfcff5af4c8e4d37989941f42a6b",
"versionType": "git"
},
{
"lessThan": "afd38b10b1c6a5c5d6952b15b990596dab9684e6",
"status": "affected",
"version": "6621a7004684bfcff5af4c8e4d37989941f42a6b",
"versionType": "git"
},
{
"lessThan": "813e18881c6472eb229a63180ff42c808e3e949b",
"status": "affected",
"version": "6621a7004684bfcff5af4c8e4d37989941f42a6b",
"versionType": "git"
},
{
"lessThan": "7539c61f522ff693d9565a0411386c2236e776cd",
"status": "affected",
"version": "6621a7004684bfcff5af4c8e4d37989941f42a6b",
"versionType": "git"
},
{
"lessThan": "b3b974008388ab59e44d764ba7a63c988fec2524",
"status": "affected",
"version": "6621a7004684bfcff5af4c8e4d37989941f42a6b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not initialize tracefs work if tracing is disabled\n\nIf trace buffer allocation fails during early boot (e.g. in\nearly_trace_init() -\u003e allocate_trace_buffers()), tracing_disabled is\nleft set to 1 and the global trace array events list remains\nuninitialized.\n\nLater during boot, tracer_init_tracefs() (invoked via fs_initcall)\nqueues tracerfs_init_work asynchronously without checking if tracing was\ndisabled. When tracer_init_tracefs_work_func() runs, it calls\nevent_trace_init() and init_tracer_tracefs(\u0026global_trace, NULL)\nunconditionally. This leads to __find_event_file() dereferencing an\nuninitialized tr-\u003eevents list, causing an early boot NULL pointer\ndereference Oops:\n\n BUG: Kernel NULL pointer dereference on read at 0x00000010\n Faulting instruction address: 0xc000000000485be0\n Oops: Kernel access of bad area, sig: 7 [#1]\n ...\n NIP [c000000000485be0] __find_event_file+0x70/0x3c0\n LR [c000000000448874] init_tracer_tracefs+0x274/0xc80\n Call Trace:\n init_tracer_tracefs+0x274/0xc80\n tracer_init_tracefs_work_func+0x50/0x320\n process_one_work+0x1e8/0x5c0\n worker_thread+0x1dc/0x3d0\n kthread+0x194/0x1b0\n start_kernel_thread+0x14/0x18\n\nCheck tracing_disabled at the beginning of tracer_init_tracefs_work_func()\nand return immediately if tracing is disabled or failed to initialize,\npreventing the crash."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:18:26.163Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e8665e884e076d894f3eed8b9ea28e37a6448604"
},
{
"url": "https://git.kernel.org/stable/c/e8cfcd7e60eaa3b0dea4d71c64499604e7081736"
},
{
"url": "https://git.kernel.org/stable/c/afd38b10b1c6a5c5d6952b15b990596dab9684e6"
},
{
"url": "https://git.kernel.org/stable/c/813e18881c6472eb229a63180ff42c808e3e949b"
},
{
"url": "https://git.kernel.org/stable/c/7539c61f522ff693d9565a0411386c2236e776cd"
},
{
"url": "https://git.kernel.org/stable/c/b3b974008388ab59e44d764ba7a63c988fec2524"
}
],
"title": "tracing: Do not initialize tracefs work if tracing is disabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99247",
"datePublished": "2026-11-03T11:18:26.163Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:18:26.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99246 (GCVE-0-2026-99246)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:18 – Updated: 2026-11-03 11:18
VLAI
EPSS
VEX
Title
tipc: protect node reset trace dump with node lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: protect node reset trace dump with node lock
The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.
This permits bearer teardown to free a link while the trace callback is
dumping it:
CPU 0 CPU 1
trace_tipc_node_reset_links()
tipc_node_dump()
l = n->links[0].link
tipc_node_write_lock()
kfree(l)
n->links[0].link = NULL
tipc_node_write_unlock()
tipc_link_dump(l)
tipc_link_dump() then dereferences the stale pointer. KASAN reported:
BUG: KASAN: slab-use-after-free in tipc_link_dump
Read of size 4 by task poc/115
Call Trace:
tipc_link_dump+0x10cb/0x16b0
tipc_node_dump+0x4bb/0x740
trace_event_raw_event_tipc_node_class+0x258/0x360
tipc_node_reset_links+0x14d/0x1a0
tipc_rcv+0x13f5/0x3030
tipc_udp_recv+0x4e3/0x670
Allocated by task 0:
tipc_link_create+0x1e1/0x1020
tipc_node_check_dest+0x7d2/0x11a0
tipc_disc_rcv+0xdbf/0x1430
Freed by task 89:
kfree+0x131/0x3c0
tipc_node_link_down+0x267/0x4b0
tipc_node_delete_links+0xec/0x160
bearer_disable+0x107/0x260
Take the node write lock around the trace event. This serializes the
dump against tipc_node_link_down(delete=true), which frees the link
under the same write lock.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < c8b72ca0918e95f708f67c8b3e69b05290f2b6d2
(git)
Affected: eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < 6e492cb98ca69cc1145175e23e22e3b84da7f26d (git) Affected: eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < 7bb6a35bd6d69019539d8782fb590fd2aa8a3236 (git) Affected: eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < 6abd93d01b0f495f29201925a5ee8e6a583c4044 (git) Affected: eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < a6101d62ccfa153db8c218ce59362b8e0316fd4f (git) Affected: eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b (git) Affected: eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < fa8c78c0e49aa11fae116fd841e41aa8f2d68751 (git) Affected: eb18a510b5cd4daeb9736ad8db57a9fc49db185b , < dddf197f29ba5e47a476dde82bf542ca2e0d5e5e (git) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.273 , ≤ 5.10.* (semver) Unaffected: 5.15.224 , ≤ 5.15.* (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.13 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8b72ca0918e95f708f67c8b3e69b05290f2b6d2",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
},
{
"lessThan": "6e492cb98ca69cc1145175e23e22e3b84da7f26d",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
},
{
"lessThan": "7bb6a35bd6d69019539d8782fb590fd2aa8a3236",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
},
{
"lessThan": "6abd93d01b0f495f29201925a5ee8e6a583c4044",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
},
{
"lessThan": "a6101d62ccfa153db8c218ce59362b8e0316fd4f",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
},
{
"lessThan": "b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
},
{
"lessThan": "fa8c78c0e49aa11fae116fd841e41aa8f2d68751",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
},
{
"lessThan": "dddf197f29ba5e47a476dde82bf542ca2e0d5e5e",
"status": "affected",
"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode\u0027s link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n CPU 0 CPU 1\n trace_tipc_node_reset_links()\n tipc_node_dump()\n l = n-\u003elinks[0].link\n tipc_node_write_lock()\n kfree(l)\n n-\u003elinks[0].link = NULL\n tipc_node_write_unlock()\n tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in tipc_link_dump\n Read of size 4 by task poc/115\n Call Trace:\n tipc_link_dump+0x10cb/0x16b0\n tipc_node_dump+0x4bb/0x740\n trace_event_raw_event_tipc_node_class+0x258/0x360\n tipc_node_reset_links+0x14d/0x1a0\n tipc_rcv+0x13f5/0x3030\n tipc_udp_recv+0x4e3/0x670\n Allocated by task 0:\n tipc_link_create+0x1e1/0x1020\n tipc_node_check_dest+0x7d2/0x11a0\n tipc_disc_rcv+0xdbf/0x1430\n Freed by task 89:\n kfree+0x131/0x3c0\n tipc_node_link_down+0x267/0x4b0\n tipc_node_delete_links+0xec/0x160\n bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:18:25.838Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2"
},
{
"url": "https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d"
},
{
"url": "https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236"
},
{
"url": "https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044"
},
{
"url": "https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f"
},
{
"url": "https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b"
},
{
"url": "https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751"
},
{
"url": "https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e"
}
],
"title": "tipc: protect node reset trace dump with node lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99246",
"datePublished": "2026-11-03T11:18:25.838Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:18:25.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99245 (GCVE-0-2026-99245)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:15 – Updated: 2026-11-03 11:15
VLAI
EPSS
VEX
Title
KEYS: Fix key_reject_and_link() race with keyring restriction
Summary
In the Linux kernel, the following vulnerability has been resolved:
KEYS: Fix key_reject_and_link() race with keyring restriction
The restrict_link check in key_reject_and_link() is done before taking
the keyring semaphore, racing with a concurrent keyring_restrict()
that installs the restriction while holding the semaphore in write
mode.
Move the check to after __key_link_lock(), so it is done under the
semaphore, matching the pattern used in __key_create_or_update().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < c7956ec99ad0e173720d95de9fa788bb077809f2
(git)
Affected: 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < 2c3d907dd15f4e30d4c35b9f7a7a5078de6a1b1f (git) Affected: 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < 72f367417a6aee56821d0b0114cfd2b080008b63 (git) Affected: 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < 19dfc37c9deefa69dc805d01d35d1f2fd7902e33 (git) Affected: 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < 5787887eba0f0979a8c86d03a8e891395d5c24ad (git) Affected: 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < 01835d3a3709be508ae5209f806640336c48e395 (git) Affected: 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < 6fc0c818b1cac66003e937c8a0d3bfb23fd3f130 (git) Affected: 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c , < 23a9163cc40b4996ba1e20533b1210a1a0bee416 (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.273 , ≤ 5.10.* (semver) Unaffected: 5.15.224 , ≤ 5.15.* (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.60 , ≤ 6.18.* (semver) Unaffected: 7.2.14 , ≤ 7.2.* (semver) Unaffected: 7.3.1 , ≤ 7.3.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7956ec99ad0e173720d95de9fa788bb077809f2",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
},
{
"lessThan": "2c3d907dd15f4e30d4c35b9f7a7a5078de6a1b1f",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
},
{
"lessThan": "72f367417a6aee56821d0b0114cfd2b080008b63",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
},
{
"lessThan": "19dfc37c9deefa69dc805d01d35d1f2fd7902e33",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
},
{
"lessThan": "5787887eba0f0979a8c86d03a8e891395d5c24ad",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
},
{
"lessThan": "01835d3a3709be508ae5209f806640336c48e395",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
},
{
"lessThan": "6fc0c818b1cac66003e937c8a0d3bfb23fd3f130",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
},
{
"lessThan": "23a9163cc40b4996ba1e20533b1210a1a0bee416",
"status": "affected",
"version": "5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: Fix key_reject_and_link() race with keyring restriction\n\nThe restrict_link check in key_reject_and_link() is done before taking\nthe keyring semaphore, racing with a concurrent keyring_restrict()\nthat installs the restriction while holding the semaphore in write\nmode.\n\nMove the check to after __key_link_lock(), so it is done under the\nsemaphore, matching the pattern used in __key_create_or_update()."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:15:43.589Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7956ec99ad0e173720d95de9fa788bb077809f2"
},
{
"url": "https://git.kernel.org/stable/c/2c3d907dd15f4e30d4c35b9f7a7a5078de6a1b1f"
},
{
"url": "https://git.kernel.org/stable/c/72f367417a6aee56821d0b0114cfd2b080008b63"
},
{
"url": "https://git.kernel.org/stable/c/19dfc37c9deefa69dc805d01d35d1f2fd7902e33"
},
{
"url": "https://git.kernel.org/stable/c/5787887eba0f0979a8c86d03a8e891395d5c24ad"
},
{
"url": "https://git.kernel.org/stable/c/01835d3a3709be508ae5209f806640336c48e395"
},
{
"url": "https://git.kernel.org/stable/c/6fc0c818b1cac66003e937c8a0d3bfb23fd3f130"
},
{
"url": "https://git.kernel.org/stable/c/23a9163cc40b4996ba1e20533b1210a1a0bee416"
}
],
"title": "KEYS: Fix key_reject_and_link() race with keyring restriction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99245",
"datePublished": "2026-11-03T11:15:15.050Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:15:43.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99244 (GCVE-0-2026-99244)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:15 – Updated: 2026-11-03 11:15
VLAI
EPSS
VEX
Title
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
Summary
In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
Since commit 7fea700e04bd ("zap_pid_ns_processes: clear
TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes()
clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise
kernel_wait4() doesn't sleep and returns -ERESTARTSYS if
signal_pending() is true and the reaper busy-waits.
But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again.
For example, klp_send_signals() sets it raw against any task that hasn't
transitioned yet. And it keeps sending it until the livepatch finishes.
The sleep loop waiting for pid_allocated to drop has the same problem
and it doesn't even clear anything. So a schedule() in
TASK_INTERRUPTIBLE returns immediately.
Use a no_notify_signal guard. signal_pending() will ignore
TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child
exits or free_pid() wakes it.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
edd2754a62bee8d97b4808a15de024f66a1ddccf , < 2c20ace1698d03a23467351be1d281e89b36ade3
(git)
Affected: 3466abafa9f4f81a869da828e52a12f693175ec2 , < 9ab0324f4868eeb20c63f063a1e5bc01d5539212 (git) Affected: 7fea700e04bd3f424c2d836e98425782f97b494e , < 30b274508c743f243c82904954c4e416d7143d4c (git) Affected: 7fea700e04bd3f424c2d836e98425782f97b494e , < 70178691c467c8f9f722765299fd8524c3121a35 (git) Affected: 7fea700e04bd3f424c2d836e98425782f97b494e , < 3d15ac36ce174477efa5365e424dbd47950fd2b9 (git) Affected: 7fea700e04bd3f424c2d836e98425782f97b494e , < f46cd8241d9b83f2279cc0db3e9d3e181b548a59 (git) Affected: 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8 (git) Affected: 8e69e589f233ca2c9631f5af2b94f95dfc2ba804 (git) Affected: 09ab5b424b17cfe633db58bb2f9edbaf9484cf20 (git) Affected: 6.1.95 , < 6.1.191 (semver) Affected: 6.6.35 , < 6.6.161 (semver) Affected: 5.10.221 , < 5.11 (semver) Affected: 5.15.162 , < 5.16 (semver) Affected: 6.9.6 , < 6.10 (semver) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.60 , ≤ 6.18.* (semver) Unaffected: 7.2.14 , ≤ 7.2.* (semver) Unaffected: 7.3.1 , ≤ 7.3.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/pid_namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c20ace1698d03a23467351be1d281e89b36ade3",
"status": "affected",
"version": "edd2754a62bee8d97b4808a15de024f66a1ddccf",
"versionType": "git"
},
{
"lessThan": "9ab0324f4868eeb20c63f063a1e5bc01d5539212",
"status": "affected",
"version": "3466abafa9f4f81a869da828e52a12f693175ec2",
"versionType": "git"
},
{
"lessThan": "30b274508c743f243c82904954c4e416d7143d4c",
"status": "affected",
"version": "7fea700e04bd3f424c2d836e98425782f97b494e",
"versionType": "git"
},
{
"lessThan": "70178691c467c8f9f722765299fd8524c3121a35",
"status": "affected",
"version": "7fea700e04bd3f424c2d836e98425782f97b494e",
"versionType": "git"
},
{
"lessThan": "3d15ac36ce174477efa5365e424dbd47950fd2b9",
"status": "affected",
"version": "7fea700e04bd3f424c2d836e98425782f97b494e",
"versionType": "git"
},
{
"lessThan": "f46cd8241d9b83f2279cc0db3e9d3e181b548a59",
"status": "affected",
"version": "7fea700e04bd3f424c2d836e98425782f97b494e",
"versionType": "git"
},
{
"status": "affected",
"version": "82c7acf9a12c9b4e4b0aba531de82b4e39a345c8",
"versionType": "git"
},
{
"status": "affected",
"version": "8e69e589f233ca2c9631f5af2b94f95dfc2ba804",
"versionType": "git"
},
{
"status": "affected",
"version": "09ab5b424b17cfe633db58bb2f9edbaf9484cf20",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.95",
"versionType": "semver"
},
{
"lessThan": "6.6.161",
"status": "affected",
"version": "6.6.35",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.221",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.162",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/pid_namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper\n\nSince commit 7fea700e04bd (\"zap_pid_ns_processes: clear\nTIF_NOTIFY_SIGNAL along with TIF_SIGPENDING\") zap_pid_ns_processes()\nclears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise\nkernel_wait4() doesn\u0027t sleep and returns -ERESTARTSYS if\nsignal_pending() is true and the reaper busy-waits.\n\nBut clearing TIF_NOTIFY_SIGNAL doesn\u0027t fix it. It can get raised again.\nFor example, klp_send_signals() sets it raw against any task that hasn\u0027t\ntransitioned yet. And it keeps sending it until the livepatch finishes.\n\nThe sleep loop waiting for pid_allocated to drop has the same problem\nand it doesn\u0027t even clear anything. So a schedule() in\nTASK_INTERRUPTIBLE returns immediately.\n\nUse a no_notify_signal guard. signal_pending() will ignore\nTIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child\nexits or free_pid() wakes it."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:15:43.093Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c20ace1698d03a23467351be1d281e89b36ade3"
},
{
"url": "https://git.kernel.org/stable/c/9ab0324f4868eeb20c63f063a1e5bc01d5539212"
},
{
"url": "https://git.kernel.org/stable/c/30b274508c743f243c82904954c4e416d7143d4c"
},
{
"url": "https://git.kernel.org/stable/c/70178691c467c8f9f722765299fd8524c3121a35"
},
{
"url": "https://git.kernel.org/stable/c/3d15ac36ce174477efa5365e424dbd47950fd2b9"
},
{
"url": "https://git.kernel.org/stable/c/f46cd8241d9b83f2279cc0db3e9d3e181b548a59"
}
],
"title": "pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99244",
"datePublished": "2026-11-03T11:15:14.715Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:15:43.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99243 (GCVE-0-2026-99243)
Vulnerability from cvelistv5 – Published: 2026-11-03 11:14 – Updated: 2026-11-03 11:15
VLAI
EPSS
VEX
Title
io-wq: order the exit bit against worker creation task work
Summary
In the Linux kernel, the following vulnerability has been resolved:
io-wq: order the exit bit against worker creation task work
io_wq_exit_workers() cancels task work for queued worker creation with
task_work_cancel_match(). That has a plain load of task->task_works.
io_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to
cancel it if the workqueue is already on its way out.
That must be ordered. task_work_add() has a full barrier via cmpxchg().
But io_wq_exit_start() sets the bit with set_bit() which doesn't have
any memory ordering.
So afaict, on weakly ordered architectures the exiting task may load
task_works before the store of the bit is visible. The other side tests
the bit before the store is visible as well. So the entry remains queued
with worker_refs and the exiting task waits on worker_done indefinitely.
If the task still has rings then io_uring_del_tctx_node() provides the
barrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it
has closed all rings though that barrier is gone.
Add the barrier after the set_bit().
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec , < 67da3eec264aeb67835886720243ae2dc1463315
(git)
Affected: 71a85387546e50b1a37b0fa45dadcae3bfb35cf6 , < a63c752157eacf49f628359822666b32503d194a (git) Affected: 71a85387546e50b1a37b0fa45dadcae3bfb35cf6 , < 1432d881d99584105122760133caeff1dce7a9f7 (git) Affected: 71a85387546e50b1a37b0fa45dadcae3bfb35cf6 , < 6cf012a4d5e461c788ecc9dbed67adc31a142644 (git) Affected: 71a85387546e50b1a37b0fa45dadcae3bfb35cf6 , < 0d81cdd433b0a96c5275c01b8172e0b1f71dd595 (git) Affected: 71a85387546e50b1a37b0fa45dadcae3bfb35cf6 , < 75395db7a9b40a2e826c838e648fef8ed1a2d174 (git) Affected: 71a85387546e50b1a37b0fa45dadcae3bfb35cf6 , < 31fc780b75b278d37700373d54a99fdb4117fdd6 (git) Affected: 5.15.11 , < 5.15.224 (semver) |
|
| Linux | Linux |
Affected:
5.16
Unaffected: 0 , < 5.16 (semver) Unaffected: 5.15.224 , ≤ 5.15.* (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.161 , ≤ 6.6.* (semver) Unaffected: 6.12.115 , ≤ 6.12.* (semver) Unaffected: 6.18.60 , ≤ 6.18.* (semver) Unaffected: 7.2.14 , ≤ 7.2.* (semver) Unaffected: 7.3.1 , ≤ 7.3.* (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/io-wq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "67da3eec264aeb67835886720243ae2dc1463315",
"status": "affected",
"version": "4b4e5bbf9386d4ec21d91c0cb0fd60b9bba778ec",
"versionType": "git"
},
{
"lessThan": "a63c752157eacf49f628359822666b32503d194a",
"status": "affected",
"version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
"versionType": "git"
},
{
"lessThan": "1432d881d99584105122760133caeff1dce7a9f7",
"status": "affected",
"version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
"versionType": "git"
},
{
"lessThan": "6cf012a4d5e461c788ecc9dbed67adc31a142644",
"status": "affected",
"version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
"versionType": "git"
},
{
"lessThan": "0d81cdd433b0a96c5275c01b8172e0b1f71dd595",
"status": "affected",
"version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
"versionType": "git"
},
{
"lessThan": "75395db7a9b40a2e826c838e648fef8ed1a2d174",
"status": "affected",
"version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
"versionType": "git"
},
{
"lessThan": "31fc780b75b278d37700373d54a99fdb4117fdd6",
"status": "affected",
"version": "71a85387546e50b1a37b0fa45dadcae3bfb35cf6",
"versionType": "git"
},
{
"lessThan": "5.15.224",
"status": "affected",
"version": "5.15.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/io-wq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: order the exit bit against worker creation task work\n\nio_wq_exit_workers() cancels task work for queued worker creation with\ntask_work_cancel_match(). That has a plain load of task-\u003etask_works.\n\nio_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to\ncancel it if the workqueue is already on its way out.\n\nThat must be ordered. task_work_add() has a full barrier via cmpxchg().\nBut io_wq_exit_start() sets the bit with set_bit() which doesn\u0027t have\nany memory ordering.\n\nSo afaict, on weakly ordered architectures the exiting task may load\ntask_works before the store of the bit is visible. The other side tests\nthe bit before the store is visible as well. So the entry remains queued\nwith worker_refs and the exiting task waits on worker_done indefinitely.\n\nIf the task still has rings then io_uring_del_tctx_node() provides the\nbarrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it\nhas closed all rings though that barrier is gone.\n\nAdd the barrier after the set_bit()."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:15:42.615Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/67da3eec264aeb67835886720243ae2dc1463315"
},
{
"url": "https://git.kernel.org/stable/c/a63c752157eacf49f628359822666b32503d194a"
},
{
"url": "https://git.kernel.org/stable/c/1432d881d99584105122760133caeff1dce7a9f7"
},
{
"url": "https://git.kernel.org/stable/c/6cf012a4d5e461c788ecc9dbed67adc31a142644"
},
{
"url": "https://git.kernel.org/stable/c/0d81cdd433b0a96c5275c01b8172e0b1f71dd595"
},
{
"url": "https://git.kernel.org/stable/c/75395db7a9b40a2e826c838e648fef8ed1a2d174"
},
{
"url": "https://git.kernel.org/stable/c/31fc780b75b278d37700373d54a99fdb4117fdd6"
}
],
"title": "io-wq: order the exit bit against worker creation task work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99243",
"datePublished": "2026-11-03T11:14:30.233Z",
"dateReserved": "2026-09-25T10:25:14.403Z",
"dateUpdated": "2026-11-03T11:15:42.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114442 (GCVE-0-2026-114442)
Vulnerability from cvelistv5 – Published: 2026-11-03 10:21 – Updated: 2026-11-03 10:21
VLAI
EPSS
VEX
Title
Apache HertzBeat: incomplete XPath expression validation in aliasFields
Summary
Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.
Severity
No CVSS data available.
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/apache/hertzbeat/pull/4481 | |
| https://lists.apache.org/thread.html/5hmlvklmmw0h… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HertzBeat |
Affected:
1.7.1
(semver)
Affected: 1.7.2 (semver) Affected: 1.7.3 (semver) Affected: 1.8.0 (semver) Affected: 1.9.0 (semver) Unaffected: 1.9.1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Apache HertzBeat",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "1.7.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.7.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.7.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.8.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.9.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.9.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "xutao"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.\u003c/p\u003e"
}
],
"value": "Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-643",
"description": "CWE-643",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T10:21:06.018Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"url": "https://github.com/apache/hertzbeat/pull/4481"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/5hmlvklmmw0hl9rb629hr6vxvq3pmspf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache HertzBeat: incomplete XPath expression validation in aliasFields",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-114442",
"datePublished": "2026-11-03T10:21:06.018Z",
"dateReserved": "2026-10-21T14:15:10.622Z",
"dateUpdated": "2026-11-03T10:21:06.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120327 (GCVE-0-2026-120327)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:56 – Updated: 2026-11-03 09:56
VLAI
EPSS
VEX
Title
Open Redirection in extension "Mail" (mail)
Summary
The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.
Severity
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Mail" |
Affected:
4.0.0 , < 4.2.0
(semver)
Affected: 0 , < 3.12.5 (semver) |
Date Public
2026-11-03 09:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "mediaessenz/mail",
"product": "Extension \"Mail\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "4.2.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexander Grein"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Grein"
}
],
"datePublic": "2026-11-03T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites."
}
],
"value": "The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:56:07.737Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-037"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Open Redirection in extension \"Mail\" (mail)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-120327",
"datePublished": "2026-11-03T09:56:07.737Z",
"dateReserved": "2026-11-01T13:30:23.578Z",
"dateUpdated": "2026-11-03T09:56:07.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120328 (GCVE-0-2026-120328)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:56 – Updated: 2026-11-03 09:56
VLAI
EPSS
VEX
Title
Information Disclosure in extension "Mail" (mail)
Summary
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Mail" |
Affected:
4.0.0 , < 4.2.0
(semver)
Affected: 0 , < 3.12.5 (semver) |
Date Public
2026-11-03 09:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "mediaessenz/mail",
"product": "Extension \"Mail\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "4.2.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexander Grein"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Grein"
}
],
"datePublic": "2026-11-03T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails."
}
],
"value": "The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:56:07.090Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-037"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Information Disclosure in extension \"Mail\" (mail)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-120328",
"datePublished": "2026-11-03T09:56:07.090Z",
"dateReserved": "2026-11-01T13:30:23.579Z",
"dateUpdated": "2026-11-03T09:56:07.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120329 (GCVE-0-2026-120329)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:56 – Updated: 2026-11-03 09:56
VLAI
EPSS
VEX
Title
Broken Access Control in extension "Mail" (mail)
Summary
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
Severity
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Mail" |
Affected:
4.0.0 , < 4.2.0
(semver)
Affected: 0 , < 3.12.5 (semver) |
Date Public
2026-11-03 09:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "mediaessenz/mail",
"product": "Extension \"Mail\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "4.2.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexander Grein"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Grein"
}
],
"datePublic": "2026-11-03T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig."
}
],
"value": "Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:56:06.446Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-037"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"Mail\" (mail)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-120329",
"datePublished": "2026-11-03T09:56:06.446Z",
"dateReserved": "2026-11-01T13:30:23.579Z",
"dateUpdated": "2026-11-03T09:56:06.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120330 (GCVE-0-2026-120330)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:56 – Updated: 2026-11-03 09:56
VLAI
EPSS
VEX
Title
Broken Access Control in extension "Mail" (mail)
Summary
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Mail" |
Affected:
4.0.0 , < 4.2.0
(semver)
Affected: 0 , < 3.12.5 (semver) |
Date Public
2026-11-03 09:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "mediaessenz/mail",
"product": "Extension \"Mail\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "4.2.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexander Grein"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Grein"
}
],
"datePublic": "2026-11-03T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients."
}
],
"value": "Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:56:05.758Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-037"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"Mail\" (mail)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-120330",
"datePublished": "2026-11-03T09:56:05.758Z",
"dateReserved": "2026-11-01T13:30:23.579Z",
"dateUpdated": "2026-11-03T09:56:05.758Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120331 (GCVE-0-2026-120331)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:56 – Updated: 2026-11-03 09:56
VLAI
EPSS
VEX
Title
Server-Side Request Forgery in extension "Mail" (mail)
Summary
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Mail" |
Affected:
4.0.0 , < 4.2.0
(semver)
Affected: 0 , < 3.12.5 (semver) |
Date Public
2026-11-03 09:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "mediaessenz/mail",
"product": "Extension \"Mail\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "4.2.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexander Grein"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Grein"
}
],
"datePublic": "2026-11-03T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network."
}
],
"value": "Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:56:05.114Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-037"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Server-Side Request Forgery in extension \"Mail\" (mail)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-120331",
"datePublished": "2026-11-03T09:56:05.114Z",
"dateReserved": "2026-11-01T13:30:23.579Z",
"dateUpdated": "2026-11-03T09:56:05.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120332 (GCVE-0-2026-120332)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:56 – Updated: 2026-11-03 09:56
VLAI
EPSS
VEX
Title
Cross-Site Scripting in extension "Mail" (mail)
Summary
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Mail" |
Affected:
4.0.0 , < 4.2.0
(semver)
Affected: 0 , < 3.12.5 (semver) |
Date Public
2026-11-03 09:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "mediaessenz/mail",
"product": "Extension \"Mail\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "4.2.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.12.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexander Grein"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexander Grein"
}
],
"datePublic": "2026-11-03T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report."
}
],
"value": "The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:56:04.383Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-037"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-Site Scripting in extension \"Mail\" (mail)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-120332",
"datePublished": "2026-11-03T09:56:04.383Z",
"dateReserved": "2026-11-01T13:30:26.351Z",
"dateUpdated": "2026-11-03T09:56:04.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120333 (GCVE-0-2026-120333)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:56 – Updated: 2026-11-03 09:56
VLAI
EPSS
VEX
Title
Broken Access Control in extension "Frontend User Registration" (sf_register)
Summary
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Frontend User Registration" |
Affected:
14.0.0 , < 14.0.3
(semver)
Affected: 0 , < 13.2.5 (semver) |
Date Public
2026-11-03 09:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "evoweb/sf-register",
"product": "Extension \"Frontend User Registration\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "14.0.3",
"status": "affected",
"version": "14.0.0",
"versionType": "semver"
},
{
"lessThan": "13.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Tobias G\u00fclzow"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sebastian Fischer"
}
],
"datePublic": "2026-11-03T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts."
}
],
"value": "The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:56:03.677Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-038"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"Frontend User Registration\" (sf_register)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-120333",
"datePublished": "2026-11-03T09:56:03.677Z",
"dateReserved": "2026-11-01T13:47:45.207Z",
"dateUpdated": "2026-11-03T09:56:03.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77691 (GCVE-0-2026-77691)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:50 – Updated: 2026-11-03 09:50
VLAI
EPSS
VEX
Title
Command injection vulnerability
Summary
ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA
Severity
8.1 (High)
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zohocorp | ManageEngine Key Manager Plus |
Affected:
0 , < 7151
(custom)
cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ManageEngine Key Manager Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "7151",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7151",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA"
}
],
"value": "ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA"
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:50:31.201Z",
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"shortName": "Zohocorp"
},
"references": [
{
"url": "https://www.manageengine.com/key-manager/advisory/cve-2026-77691.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Command injection vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"assignerShortName": "Zohocorp",
"cveId": "CVE-2026-77691",
"datePublished": "2026-11-03T09:50:31.201Z",
"dateReserved": "2026-08-21T07:38:29.169Z",
"dateUpdated": "2026-11-03T09:50:31.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89229 (GCVE-0-2026-89229)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:46 – Updated: 2026-11-03 09:46
VLAI
EPSS
VEX
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vivo | BlueLM Copilot |
Affected:
0 , < 7.2.0.0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BlueLM Copilot",
"vendor": "vivo",
"versions": [
{
"lessThan": "7.2.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application\u0026nbsp;installed on the same device\u0026nbsp;to write arbitrary files\u0026nbsp;via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing \u0027..\u0027 sequences."
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application\u00a0installed on the same device\u00a0to write arbitrary files\u00a0via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing \u0027..\u0027 sequences."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious application installed on the same device can write arbitrary files to locations outside the intended shared directory, potentially leading to data tampering, denial of service, or further privilege escalation depending on the reachable write path."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:46:55.368Z",
"orgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8",
"shortName": "Vivo"
},
"references": [
{
"url": "https://www.vivo.com/en/support/security-advisory-detail?id=26"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c6f5cd8e-fe3d-4460-82c2-f8a4e7b272c8",
"assignerShortName": "Vivo",
"cveId": "CVE-2026-89229",
"datePublished": "2026-11-03T09:46:55.368Z",
"dateReserved": "2026-09-11T09:24:48.341Z",
"dateUpdated": "2026-11-03T09:46:55.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119843 (GCVE-0-2026-119843)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:45 – Updated: 2026-11-03 09:45
VLAI
EPSS
VEX
Title
Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags
Summary
A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.
Severity
6.5 (Medium)
CWE
- CWE-617 - Reachable Assertion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-119843 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2564182 | issue-trackingx_refsource_REDHAT |
| https://gitlab.freedesktop.org/gstreamer/gstreame… | |
| https://gstreamer.freedesktop.org/security/sa-202… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| GStreamer project | gst-plugins-good |
Affected:
0 , < 1.28.2
(semver)
Unaffected: 1.28.2 |
Date Public
2026-04-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-good",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-good",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-good",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-good",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://gstreamer.freedesktop.org/",
"product": "gst-plugins-good",
"vendor": "GStreamer project",
"versions": [
{
"lessThan": "1.28.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.28.2"
}
]
}
],
"datePublic": "2026-04-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in GStreamer\u0027s gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:45:25.949Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-119843"
},
{
"name": "RHBZ#2564182",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564182"
},
{
"url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11244.patch"
},
{
"url": "https://gstreamer.freedesktop.org/security/sa-2026-0020.html"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-07T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-07T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags",
"workarounds": [
{
"lang": "en",
"value": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-119843",
"datePublished": "2026-11-03T09:45:25.949Z",
"dateReserved": "2026-10-30T16:41:04.521Z",
"dateUpdated": "2026-11-03T09:45:25.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}