Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18367 vulnerabilities
CVE-2026-99099 (GCVE-0-2026-99099)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
x86/CPU/AMD: Fix AMD TLBI Erratum #1718
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/CPU/AMD: Fix AMD TLBI Erratum #1718
The processor may fail to invalidate a TLB entry while executing an
INVLPGB/TLBSYNC instruction pair.
Detect the erratum and apply a software workaround when a microcode fix
is not present.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
82378c6c2f435dba66145609de16bf44a9de6303 , < e3e6779f77ab6f0a1aa80e24868d2d89f31053fe
(git)
Affected: 82378c6c2f435dba66145609de16bf44a9de6303 , < 098d80b04d0fe02889c332d061db968f070b83a6 (git) Affected: 82378c6c2f435dba66145609de16bf44a9de6303 , < 87db7795cbaaf636ae22ae031f4906db7bb77803 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/cpufeatures.h",
"arch/x86/include/asm/tlb.h",
"arch/x86/kernel/cpu/amd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e3e6779f77ab6f0a1aa80e24868d2d89f31053fe",
"status": "affected",
"version": "82378c6c2f435dba66145609de16bf44a9de6303",
"versionType": "git"
},
{
"lessThan": "098d80b04d0fe02889c332d061db968f070b83a6",
"status": "affected",
"version": "82378c6c2f435dba66145609de16bf44a9de6303",
"versionType": "git"
},
{
"lessThan": "87db7795cbaaf636ae22ae031f4906db7bb77803",
"status": "affected",
"version": "82378c6c2f435dba66145609de16bf44a9de6303",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/cpufeatures.h",
"arch/x86/include/asm/tlb.h",
"arch/x86/kernel/cpu/amd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Fix AMD TLBI Erratum #1718\n\nThe processor may fail to invalidate a TLB entry while executing an\nINVLPGB/TLBSYNC instruction pair.\n\nDetect the erratum and apply a software workaround when a microcode fix\nis not present."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:04.997Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e3e6779f77ab6f0a1aa80e24868d2d89f31053fe"
},
{
"url": "https://git.kernel.org/stable/c/098d80b04d0fe02889c332d061db968f070b83a6"
},
{
"url": "https://git.kernel.org/stable/c/87db7795cbaaf636ae22ae031f4906db7bb77803"
}
],
"title": "x86/CPU/AMD: Fix AMD TLBI Erratum #1718",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99099",
"datePublished": "2026-10-26T14:52:04.997Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-10-26T14:52:04.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99098 (GCVE-0-2026-99098)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
dm-integrity: fix buffer overflow in inline mode with large tag size
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix buffer overflow in inline mode with large tag size
In inline mode, dm_integrity_check and dm_integrity_inline_recheck
compute the checksum of each block into an on-stack buffer of
HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result
with zeroes up to the tag size, so if the tag size is larger than
HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With
CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the
first read.
Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5
("dm integrity: fix a crash with unusually large tag size") did for
integrity_metadata.
Note that this is not a security bug because the buffer overflow can only
be triggered by root.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fb0987682c629c1d2c476f35f6fde405a5e304a4 , < 3c7aad85aeb9e28386672e3a009aa2e61f751b86
(git)
Affected: fb0987682c629c1d2c476f35f6fde405a5e304a4 , < 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165 (git) Affected: fb0987682c629c1d2c476f35f6fde405a5e304a4 , < f49cd7820cd0a96f20e1aa2708adb002124e38a7 (git) Affected: fb0987682c629c1d2c476f35f6fde405a5e304a4 , < 764b683a6180fd72c931c13fea98d383506a3475 (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c7aad85aeb9e28386672e3a009aa2e61f751b86",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
},
{
"lessThan": "4f0ee735dc68e3e6c4dd9a666d7f7047163c4165",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
},
{
"lessThan": "f49cd7820cd0a96f20e1aa2708adb002124e38a7",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
},
{
"lessThan": "764b683a6180fd72c931c13fea98d383506a3475",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow in inline mode with large tag size\n\nIn inline mode, dm_integrity_check and dm_integrity_inline_recheck\ncompute the checksum of each block into an on-stack buffer of\nHASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result\nwith zeroes up to the tag size, so if the tag size is larger than\nHASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With\nCONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the\nfirst read.\n\nEnlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5\n(\"dm integrity: fix a crash with unusually large tag size\") did for\nintegrity_metadata.\n\nNote that this is not a security bug because the buffer overflow can only\nbe triggered by root."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:04.416Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c7aad85aeb9e28386672e3a009aa2e61f751b86"
},
{
"url": "https://git.kernel.org/stable/c/4f0ee735dc68e3e6c4dd9a666d7f7047163c4165"
},
{
"url": "https://git.kernel.org/stable/c/f49cd7820cd0a96f20e1aa2708adb002124e38a7"
},
{
"url": "https://git.kernel.org/stable/c/764b683a6180fd72c931c13fea98d383506a3475"
}
],
"title": "dm-integrity: fix buffer overflow in inline mode with large tag size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99098",
"datePublished": "2026-10-26T14:52:04.416Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-10-26T14:52:04.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99097 (GCVE-0-2026-99097)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size
and passes it to alloc_pages_exact() without checking it. For size == 0
nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is
documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page
allocator then trips its order > MAX_PAGE_ORDER warning and fails the
allocation; on a panic_on_warn kernel that ends the boot.
This can be triggered by TEE_IOC_SHM_ALLOC with struct
tee_ioctl_shm_alloc_data where size is 0.
Reject a zero page count, as register_shm_helper() already does for the
register path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cf4441503e20a0c0a36e0a98dcf57de3d3844c91 , < e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d
(git)
Affected: cf4441503e20a0c0a36e0a98dcf57de3d3844c91 , < 65cb86860a80ffc6af897d53f5bd4b1733bca0ec (git) Affected: cf4441503e20a0c0a36e0a98dcf57de3d3844c91 , < c2a97703359e25ec7ef8b2b0ef32fb3982add90a (git) Affected: cf4441503e20a0c0a36e0a98dcf57de3d3844c91 , < b7f925fd5226deb953c8dcdc9677d3fcc2717c00 (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tee/tee_shm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d",
"status": "affected",
"version": "cf4441503e20a0c0a36e0a98dcf57de3d3844c91",
"versionType": "git"
},
{
"lessThan": "65cb86860a80ffc6af897d53f5bd4b1733bca0ec",
"status": "affected",
"version": "cf4441503e20a0c0a36e0a98dcf57de3d3844c91",
"versionType": "git"
},
{
"lessThan": "c2a97703359e25ec7ef8b2b0ef32fb3982add90a",
"status": "affected",
"version": "cf4441503e20a0c0a36e0a98dcf57de3d3844c91",
"versionType": "git"
},
{
"lessThan": "b7f925fd5226deb953c8dcdc9677d3fcc2717c00",
"status": "affected",
"version": "cf4441503e20a0c0a36e0a98dcf57de3d3844c91",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tee/tee_shm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()\n\ntee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size\nand passes it to alloc_pages_exact() without checking it. For size == 0\nnr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is\ndocumented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page\nallocator then trips its order \u003e MAX_PAGE_ORDER warning and fails the\nallocation; on a panic_on_warn kernel that ends the boot.\n\nThis can be triggered by TEE_IOC_SHM_ALLOC with struct\ntee_ioctl_shm_alloc_data where size is 0.\n\nReject a zero page count, as register_shm_helper() already does for the\nregister path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:03.824Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d"
},
{
"url": "https://git.kernel.org/stable/c/65cb86860a80ffc6af897d53f5bd4b1733bca0ec"
},
{
"url": "https://git.kernel.org/stable/c/c2a97703359e25ec7ef8b2b0ef32fb3982add90a"
},
{
"url": "https://git.kernel.org/stable/c/b7f925fd5226deb953c8dcdc9677d3fcc2717c00"
}
],
"title": "tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99097",
"datePublished": "2026-10-26T14:52:03.824Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:03.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99096 (GCVE-0-2026-99096)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
io_uring/register: don't exempt disabled rings from task restrictions
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/register: don't exempt disabled rings from task restrictions
A ring created with IORING_SETUP_R_DISABLED is exempt from its register
restrictions until it is enabled. This lets the creator register the
restrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,
whether or not that opcode is in the allowed set.
Since commit ed82f35b926b ("io_uring: allow registration of per-task
restrictions"), a ring also inherits restrictions from the task that
creates it, and the same exemption applies to those. A task whose
register opcodes are restricted can therefore create a disabled ring,
issue any register opcode on it, and then enable it.
Mark rings whose restrictions were inherited from the task, and keep
checking register opcodes for them while the ring is disabled. Enabling
such a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the
task's allowed set. Per-ring restrictions registered on a disabled ring
work as before.
[axboe: amend with inheritance flag fixup]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ed82f35b926b2e505c14b7006473614b8f58b4f4 , < f55c240192ded562386de843bfa067671d2731d5
(git)
Affected: ed82f35b926b2e505c14b7006473614b8f58b4f4 , < 6da8f402e362b2f546e2efb7167fc9597aef6faf (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/io_uring.c",
"io_uring/register.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f55c240192ded562386de843bfa067671d2731d5",
"status": "affected",
"version": "ed82f35b926b2e505c14b7006473614b8f58b4f4",
"versionType": "git"
},
{
"lessThan": "6da8f402e362b2f546e2efb7167fc9597aef6faf",
"status": "affected",
"version": "ed82f35b926b2e505c14b7006473614b8f58b4f4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/io_uring.c",
"io_uring/register.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/register: don\u0027t exempt disabled rings from task restrictions\n\nA ring created with IORING_SETUP_R_DISABLED is exempt from its register\nrestrictions until it is enabled. This lets the creator register the\nrestrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,\nwhether or not that opcode is in the allowed set.\n\nSince commit ed82f35b926b (\"io_uring: allow registration of per-task\nrestrictions\"), a ring also inherits restrictions from the task that\ncreates it, and the same exemption applies to those. A task whose\nregister opcodes are restricted can therefore create a disabled ring,\nissue any register opcode on it, and then enable it.\n\nMark rings whose restrictions were inherited from the task, and keep\nchecking register opcodes for them while the ring is disabled. Enabling\nsuch a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the\ntask\u0027s allowed set. Per-ring restrictions registered on a disabled ring\nwork as before.\n\n[axboe: amend with inheritance flag fixup]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:03.236Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f55c240192ded562386de843bfa067671d2731d5"
},
{
"url": "https://git.kernel.org/stable/c/6da8f402e362b2f546e2efb7167fc9597aef6faf"
}
],
"title": "io_uring/register: don\u0027t exempt disabled rings from task restrictions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99096",
"datePublished": "2026-10-26T14:52:03.236Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:03.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99095 (GCVE-0-2026-99095)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
drm/vc4: drain the hangcheck timer and works on V3D unbind
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: drain the hangcheck timer and works on V3D unbind
Nothing stops the hangcheck timer that submitted jobs arm, or the
job_done_work that the render-done interrupt queues, at teardown:
vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()
runs from the drm-managed release, after vc4_v3d_unbind() has already
uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed
by then reads V3D registers through the NULL vc4->v3d pointer, and the
late callbacks run on the vc4_dev embedding them after it has been
freed.
Drain them in vc4_v3d_unbind(): shut the timer down and cancel
reset_work before the interrupt is taken down, because its
vc4_irq_reset() re-enables it, then flush job_done_work so that
completions queued at teardown still release their jobs.
This issue was found by an in-house static analysis tool.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 , < 17c5fa371de2d5508755cd4cd227cc8e2bb99240
(git)
Affected: d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 , < a046cd60ff3f4a8c8e672b3b18902682c1f91731 (git) Affected: d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 , < e61465d3e0292daebf4dbb34e0add635e2439569 (git) Affected: d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 , < ade226dfd28cf2fd1dce143c556d1ee77d953696 (git) Affected: d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 , < 94cf5971b1d04c6382437387c4dc3836cc7a1437 (git) |
|
| Linux | Linux |
Affected:
4.5
Unaffected: 0 , < 4.5 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_v3d.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "17c5fa371de2d5508755cd4cd227cc8e2bb99240",
"status": "affected",
"version": "d5b1a78a772f1e31a94f8babfa964152ec5e9aa5",
"versionType": "git"
},
{
"lessThan": "a046cd60ff3f4a8c8e672b3b18902682c1f91731",
"status": "affected",
"version": "d5b1a78a772f1e31a94f8babfa964152ec5e9aa5",
"versionType": "git"
},
{
"lessThan": "e61465d3e0292daebf4dbb34e0add635e2439569",
"status": "affected",
"version": "d5b1a78a772f1e31a94f8babfa964152ec5e9aa5",
"versionType": "git"
},
{
"lessThan": "ade226dfd28cf2fd1dce143c556d1ee77d953696",
"status": "affected",
"version": "d5b1a78a772f1e31a94f8babfa964152ec5e9aa5",
"versionType": "git"
},
{
"lessThan": "94cf5971b1d04c6382437387c4dc3836cc7a1437",
"status": "affected",
"version": "d5b1a78a772f1e31a94f8babfa964152ec5e9aa5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_v3d.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: drain the hangcheck timer and works on V3D unbind\n\nNothing stops the hangcheck timer that submitted jobs arm, or the\njob_done_work that the render-done interrupt queues, at teardown:\nvc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()\nruns from the drm-managed release, after vc4_v3d_unbind() has already\nuninstalled the V3D interrupt and cleared vc4-\u003ev3d. A timer still armed\nby then reads V3D registers through the NULL vc4-\u003ev3d pointer, and the\nlate callbacks run on the vc4_dev embedding them after it has been\nfreed.\n\nDrain them in vc4_v3d_unbind(): shut the timer down and cancel\nreset_work before the interrupt is taken down, because its\nvc4_irq_reset() re-enables it, then flush job_done_work so that\ncompletions queued at teardown still release their jobs.\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:02.647Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/17c5fa371de2d5508755cd4cd227cc8e2bb99240"
},
{
"url": "https://git.kernel.org/stable/c/a046cd60ff3f4a8c8e672b3b18902682c1f91731"
},
{
"url": "https://git.kernel.org/stable/c/e61465d3e0292daebf4dbb34e0add635e2439569"
},
{
"url": "https://git.kernel.org/stable/c/ade226dfd28cf2fd1dce143c556d1ee77d953696"
},
{
"url": "https://git.kernel.org/stable/c/94cf5971b1d04c6382437387c4dc3836cc7a1437"
}
],
"title": "drm/vc4: drain the hangcheck timer and works on V3D unbind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99095",
"datePublished": "2026-10-26T14:52:02.647Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:02.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99094 (GCVE-0-2026-99094)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
Bluetooth: btintel_pcie: fix TX descriptor bounds check
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: fix TX descriptor bounds check
btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data
buffer arrays before the index is advanced modulo txq->count. An index
equal to txq->count is one past the end of both arrays, so reject it in
the bounds check.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6e65a09f927566f257322358d429b267548473eb , < 08704ec6d4bf69725e7815b09a9b5c7af83e255b
(git)
Affected: 6e65a09f927566f257322358d429b267548473eb , < 39ab048cce70d50af48015f5f294c4cf80d6ba89 (git) Affected: 6e65a09f927566f257322358d429b267548473eb , < 2669567615215d52fb306053cbcc1f53dc386158 (git) Affected: 6e65a09f927566f257322358d429b267548473eb , < baa53af641c9e3644e717b8dfd1b95a55a0c111b (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btintel_pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08704ec6d4bf69725e7815b09a9b5c7af83e255b",
"status": "affected",
"version": "6e65a09f927566f257322358d429b267548473eb",
"versionType": "git"
},
{
"lessThan": "39ab048cce70d50af48015f5f294c4cf80d6ba89",
"status": "affected",
"version": "6e65a09f927566f257322358d429b267548473eb",
"versionType": "git"
},
{
"lessThan": "2669567615215d52fb306053cbcc1f53dc386158",
"status": "affected",
"version": "6e65a09f927566f257322358d429b267548473eb",
"versionType": "git"
},
{
"lessThan": "baa53af641c9e3644e717b8dfd1b95a55a0c111b",
"status": "affected",
"version": "6e65a09f927566f257322358d429b267548473eb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btintel_pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix TX descriptor bounds check\n\nbtintel_pcie_prepare_tx() uses tfd_index to access the TFD and data\nbuffer arrays before the index is advanced modulo txq-\u003ecount. An index\nequal to txq-\u003ecount is one past the end of both arrays, so reject it in\nthe bounds check."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:02.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08704ec6d4bf69725e7815b09a9b5c7af83e255b"
},
{
"url": "https://git.kernel.org/stable/c/39ab048cce70d50af48015f5f294c4cf80d6ba89"
},
{
"url": "https://git.kernel.org/stable/c/2669567615215d52fb306053cbcc1f53dc386158"
},
{
"url": "https://git.kernel.org/stable/c/baa53af641c9e3644e717b8dfd1b95a55a0c111b"
}
],
"title": "Bluetooth: btintel_pcie: fix TX descriptor bounds check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99094",
"datePublished": "2026-10-26T14:52:02.053Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:02.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99093 (GCVE-0-2026-99093)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
mm: don't schedule deferred kernel page table freeing while booting
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: don't schedule deferred kernel page table freeing while booting
Booting with a boot-time function tracer and a filter, for example
ftrace=function ftrace_filter=pud_free_pmd_page
panics on 7.3-rc4 as soon as the tracer starts:
[ 23.531178] Starting tracer 'function'
[ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI
[ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]
[ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)
[ 24.252248] RIP: 0010:__queue_work+0xab/0xf00
[ 25.981629] Call Trace:
[ 26.125727] <TASK>
[ 26.413912] ? pagetable_free_kernel+0x20/0x120
[ 26.990283] queue_work_on+0x97/0xf0
[ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0
[ 27.566662] cpa_flush+0x394/0x620
[ 27.998953] change_page_attr_set_clr+0x321/0x4a0
[ 29.151729] set_memory_rox+0xa2/0xf0
[ 29.584018] create_trampoline+0x431/0x6f0
...
[ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!
The boot-time tracer is started from early_trace_init(), which runs
before workqueue_init_early(). Making its trampoline read-only splits a
large page, and CPA collapses it again right away. The split table has
been a kernel page table since commit 9e4a3ec3411b
("x86/mm/pat: Allocate split page tables as kernel page tables"), so the
collapse frees it through pagetable_free_kernel(), which queues work on
system_percpu_wq - still NULL at that point. That commit is correct in
itself; it only lets CPA reach pagetable_free_kernel() before the
workqueue that function relies on exists.
Keep putting the table on the list, but don't schedule the work while
the system is still booting. A core_initcall schedules it once to free
whatever was queued by then.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
84e0cd79d57f06b872154eb5d8f610584133f260 , < 7a25ca170c12a9328f6fcf4410713beb516b01c0
(git)
Affected: 922873cf4fc34124215070a8ad391bf831538bb9 , < df6c704a08bc0925d5db047b0a6221f962bda4d9 (git) Affected: 9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4 , < 2fb552b0bee70c24c092720028ab4620f5eb2646 (git) |
|
| Linux | Linux |
Affected:
6.18.53 , < 6.18.57
(semver)
Affected: 7.2.7 , < 7.2.11 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/pgtable-generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a25ca170c12a9328f6fcf4410713beb516b01c0",
"status": "affected",
"version": "84e0cd79d57f06b872154eb5d8f610584133f260",
"versionType": "git"
},
{
"lessThan": "df6c704a08bc0925d5db047b0a6221f962bda4d9",
"status": "affected",
"version": "922873cf4fc34124215070a8ad391bf831538bb9",
"versionType": "git"
},
{
"lessThan": "2fb552b0bee70c24c092720028ab4620f5eb2646",
"status": "affected",
"version": "9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/pgtable-generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.18.57",
"status": "affected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThan": "7.2.11",
"status": "affected",
"version": "7.2.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.18.53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "7.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: don\u0027t schedule deferred kernel page table freeing while booting\n\nBooting with a boot-time function tracer and a filter, for example\n\n ftrace=function ftrace_filter=pud_free_pmd_page\n\npanics on 7.3-rc4 as soon as the tracer starts:\n\n [ 23.531178] Starting tracer \u0027function\u0027\n [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI\n [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)\n [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00\n [ 25.981629] Call Trace:\n [ 26.125727] \u003cTASK\u003e\n [ 26.413912] ? pagetable_free_kernel+0x20/0x120\n [ 26.990283] queue_work_on+0x97/0xf0\n [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0\n [ 27.566662] cpa_flush+0x394/0x620\n [ 27.998953] change_page_attr_set_clr+0x321/0x4a0\n [ 29.151729] set_memory_rox+0xa2/0xf0\n [ 29.584018] create_trampoline+0x431/0x6f0\n ...\n [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!\n\nThe boot-time tracer is started from early_trace_init(), which runs\nbefore workqueue_init_early(). Making its trampoline read-only splits a\nlarge page, and CPA collapses it again right away. The split table has\nbeen a kernel page table since commit 9e4a3ec3411b\n(\"x86/mm/pat: Allocate split page tables as kernel page tables\"), so the\ncollapse frees it through pagetable_free_kernel(), which queues work on\nsystem_percpu_wq - still NULL at that point. That commit is correct in\nitself; it only lets CPA reach pagetable_free_kernel() before the\nworkqueue that function relies on exists.\n\nKeep putting the table on the list, but don\u0027t schedule the work while\nthe system is still booting. A core_initcall schedules it once to free\nwhatever was queued by then."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:01.450Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a25ca170c12a9328f6fcf4410713beb516b01c0"
},
{
"url": "https://git.kernel.org/stable/c/df6c704a08bc0925d5db047b0a6221f962bda4d9"
},
{
"url": "https://git.kernel.org/stable/c/2fb552b0bee70c24c092720028ab4620f5eb2646"
}
],
"title": "mm: don\u0027t schedule deferred kernel page table freeing while booting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99093",
"datePublished": "2026-10-26T14:52:01.450Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:01.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99092 (GCVE-0-2026-99092)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
riscv: patch: fix handling of bpf-jit execmem addresses
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: patch: fix handling of bpf-jit execmem addresses
Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text
is already writable") gated the core_kernel_text() branch of patch_map()
on CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch
unchanged. That branch has a separate problem.
That branch only creates a temporary writable fixmap alias when
CONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is
directly writable and returns the address unchanged. That assumption no
longer holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack
unconditionally in alloc_new_pack(), independently of any
CONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only
regardless of what CONFIG_STRICT_MODULE_RWX says.
With CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only
address directly, the subsequent copy_to_kernel_nofault() takes a
page fault and returns -EFAULT. bpf_arch_text_copy() turns that into
-EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the
WARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed.
Note that BPF cannot be fixed the way kprobes was in
commit bdc46e507b59 ("riscv: mm: make EXECMEM_KPROBES writable without
CONFIG_STRICT_MODULE_RWX"). EXECMEM_BPF is already PAGE_KERNEL, i.e.
writable at allocation time; the read-only mapping is established
afterwards by generic code in alloc_new_pack(), which arch code cannot
influence. The only place this can be handled is patch_map().
This is the same problem that was fixed on arm64 by commit b1480ed230ac
("arm64: patching: fix handling of execmem addresses"), and the fix is
the same: CONFIG_EXECMEM is what actually tracks whether the vmalloc
area can hold executable memory that needs a temporary alias to be
written. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select
it.
Note that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv
selects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can
be disabled with CONFIG_MODULES=y as well, and the bug is reachable in
that configuration too.
The !CONFIG_MMU build is unaffected: it has its own __patch_insn_set()
and __patch_insn_write() implementations and never calls patch_map().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2c9e5d4a008293407836d29d35dfd4353615bd2f , < 562a35b9e0b3d9483d9472995219cadb3592db3d
(git)
Affected: 2c9e5d4a008293407836d29d35dfd4353615bd2f , < 9e8fc7972b398e9dc2415ece283d8f64edac3858 (git) Affected: 2c9e5d4a008293407836d29d35dfd4353615bd2f , < f71d6ea3843c8038c431c2699482f246aea37ca0 (git) Affected: 2c9e5d4a008293407836d29d35dfd4353615bd2f , < a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06 (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/patch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "562a35b9e0b3d9483d9472995219cadb3592db3d",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
},
{
"lessThan": "9e8fc7972b398e9dc2415ece283d8f64edac3858",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
},
{
"lessThan": "f71d6ea3843c8038c431c2699482f246aea37ca0",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
},
{
"lessThan": "a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/patch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: patch: fix handling of bpf-jit execmem addresses\n\nCommit 8718e5a3090b (\"riscv: patch: skip fixmap mapping when kernel text\nis already writable\") gated the core_kernel_text() branch of patch_map()\non CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch\nunchanged. That branch has a separate problem.\n\nThat branch only creates a temporary writable fixmap alias when\nCONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is\ndirectly writable and returns the address unchanged. That assumption no\nlonger holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack\nunconditionally in alloc_new_pack(), independently of any\nCONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only\nregardless of what CONFIG_STRICT_MODULE_RWX says.\n\nWith CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only\naddress directly, the subsequent copy_to_kernel_nofault() takes a\npage fault and returns -EFAULT. bpf_arch_text_copy() turns that into\n-EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the\nWARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed.\n\nNote that BPF cannot be fixed the way kprobes was in\ncommit bdc46e507b59 (\"riscv: mm: make EXECMEM_KPROBES writable without\nCONFIG_STRICT_MODULE_RWX\"). EXECMEM_BPF is already PAGE_KERNEL, i.e.\nwritable at allocation time; the read-only mapping is established\nafterwards by generic code in alloc_new_pack(), which arch code cannot\ninfluence. The only place this can be handled is patch_map().\n\nThis is the same problem that was fixed on arm64 by commit b1480ed230ac\n(\"arm64: patching: fix handling of execmem addresses\"), and the fix is\nthe same: CONFIG_EXECMEM is what actually tracks whether the vmalloc\narea can hold executable memory that needs a temporary alias to be\nwritten. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select\nit.\n\nNote that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv\nselects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can\nbe disabled with CONFIG_MODULES=y as well, and the bug is reachable in\nthat configuration too.\n\nThe !CONFIG_MMU build is unaffected: it has its own __patch_insn_set()\nand __patch_insn_write() implementations and never calls patch_map()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:00.860Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/562a35b9e0b3d9483d9472995219cadb3592db3d"
},
{
"url": "https://git.kernel.org/stable/c/9e8fc7972b398e9dc2415ece283d8f64edac3858"
},
{
"url": "https://git.kernel.org/stable/c/f71d6ea3843c8038c431c2699482f246aea37ca0"
},
{
"url": "https://git.kernel.org/stable/c/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06"
}
],
"title": "riscv: patch: fix handling of bpf-jit execmem addresses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99092",
"datePublished": "2026-10-26T14:52:00.860Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:00.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99091 (GCVE-0-2026-99091)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:52 – Updated: 2026-10-26 14:52
VLAI
EPSS
VEX
Title
Bluetooth: MGMT: Fix status of pending commands flushed on power off
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix status of pending commands flushed on power off
cmd_complete_rsp() receives a struct cmd_lookup and, for a pending
command that has no cmd_complete callback, falls through to
cmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so
the status sent comes from the first byte of match->sk's
representation, not from match->mgmt_status.
commit f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on
mgmt_index_removed") changed the callers' data from &status to &match
and updated the cmd_complete branch to match->mgmt_status, but left
the fall-through passing data unchanged.
In mgmt_index_removed() match->sk is NULL, so every such command is
answered with status 0x00 (Success) instead of
MGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too,
unless a Set Powered command was pending: then settings_rsp() has
stored that command's socket in match->sk, and the byte sent comes
from the socket pointer. Either way the status the caller set,
MGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the device
is being unregistered), is lost.
Pass the status the callers set.
This was seen on a QCA9377 laptop: bluetoothd's Start Discovery,
pending when the adapter was powered off, was answered with Command
Status 0x00 and no parameters, and bluetoothd 5.72 crashed on the
zero-length success. BlueZ master has since added the length check
on that path ("adapter: Fix crash on short start discovery reply",
BlueZ a734b06059cb), but userspace should still be told Not Powered,
not Success.
Tested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci):
power off is held in HCI Write Scan Enable while a Start Discovery is
submitted, and the flush answers it with status 0x00 before this
change and 0x0f (Not Powered) after.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4883296505aa7e4863c6869b689afb6005633b23 , < 44ce36c5789ac84e65de1e98c32db9a5ac04ed47
(git)
Affected: f53e1c9c726d83092167f2226f32bd3b73f26c21 , < 7ed7e038b520cf0dfa12d61c2caddb95e2f6922d (git) Affected: f53e1c9c726d83092167f2226f32bd3b73f26c21 , < ec227cddd13cd7ac9077d263a73473ac370a055d (git) Affected: f53e1c9c726d83092167f2226f32bd3b73f26c21 , < 07976405a3c71253e50533ee7b7a8b0dc16ab6ba (git) Affected: f53e1c9c726d83092167f2226f32bd3b73f26c21 , < 86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc (git) Affected: 19b40ca62607cef78369549d1af091f2fd558931 (git) Affected: 0cc47233af35fb5f10b5e6a027cb4ccd480caf9a (git) Affected: 8c3f7943a29145d8a2d8e24893762f7673323eae (git) Affected: 6.6.55 , < 6.6.160 (semver) Affected: 6.1.120 , < 6.2 (semver) Affected: 6.10.14 , < 6.11 (semver) Affected: 6.11.3 , < 6.12 (semver) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44ce36c5789ac84e65de1e98c32db9a5ac04ed47",
"status": "affected",
"version": "4883296505aa7e4863c6869b689afb6005633b23",
"versionType": "git"
},
{
"lessThan": "7ed7e038b520cf0dfa12d61c2caddb95e2f6922d",
"status": "affected",
"version": "f53e1c9c726d83092167f2226f32bd3b73f26c21",
"versionType": "git"
},
{
"lessThan": "ec227cddd13cd7ac9077d263a73473ac370a055d",
"status": "affected",
"version": "f53e1c9c726d83092167f2226f32bd3b73f26c21",
"versionType": "git"
},
{
"lessThan": "07976405a3c71253e50533ee7b7a8b0dc16ab6ba",
"status": "affected",
"version": "f53e1c9c726d83092167f2226f32bd3b73f26c21",
"versionType": "git"
},
{
"lessThan": "86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc",
"status": "affected",
"version": "f53e1c9c726d83092167f2226f32bd3b73f26c21",
"versionType": "git"
},
{
"status": "affected",
"version": "19b40ca62607cef78369549d1af091f2fd558931",
"versionType": "git"
},
{
"status": "affected",
"version": "0cc47233af35fb5f10b5e6a027cb4ccd480caf9a",
"versionType": "git"
},
{
"status": "affected",
"version": "8c3f7943a29145d8a2d8e24893762f7673323eae",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.55",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.14",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix status of pending commands flushed on power off\n\ncmd_complete_rsp() receives a struct cmd_lookup and, for a pending\ncommand that has no cmd_complete callback, falls through to\ncmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so\nthe status sent comes from the first byte of match-\u003esk\u0027s\nrepresentation, not from match-\u003emgmt_status.\n\ncommit f53e1c9c726d (\"Bluetooth: MGMT: Fix possible crash on\nmgmt_index_removed\") changed the callers\u0027 data from \u0026status to \u0026match\nand updated the cmd_complete branch to match-\u003emgmt_status, but left\nthe fall-through passing data unchanged.\n\nIn mgmt_index_removed() match-\u003esk is NULL, so every such command is\nanswered with status 0x00 (Success) instead of\nMGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too,\nunless a Set Powered command was pending: then settings_rsp() has\nstored that command\u0027s socket in match-\u003esk, and the byte sent comes\nfrom the socket pointer. Either way the status the caller set,\nMGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the device\nis being unregistered), is lost.\n\nPass the status the callers set.\n\nThis was seen on a QCA9377 laptop: bluetoothd\u0027s Start Discovery,\npending when the adapter was powered off, was answered with Command\nStatus 0x00 and no parameters, and bluetoothd 5.72 crashed on the\nzero-length success. BlueZ master has since added the length check\non that path (\"adapter: Fix crash on short start discovery reply\",\nBlueZ a734b06059cb), but userspace should still be told Not Powered,\nnot Success.\n\nTested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci):\npower off is held in HCI Write Scan Enable while a Start Discovery is\nsubmitted, and the flush answers it with status 0x00 before this\nchange and 0x0f (Not Powered) after."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:00.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44ce36c5789ac84e65de1e98c32db9a5ac04ed47"
},
{
"url": "https://git.kernel.org/stable/c/7ed7e038b520cf0dfa12d61c2caddb95e2f6922d"
},
{
"url": "https://git.kernel.org/stable/c/ec227cddd13cd7ac9077d263a73473ac370a055d"
},
{
"url": "https://git.kernel.org/stable/c/07976405a3c71253e50533ee7b7a8b0dc16ab6ba"
},
{
"url": "https://git.kernel.org/stable/c/86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc"
}
],
"title": "Bluetooth: MGMT: Fix status of pending commands flushed on power off",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99091",
"datePublished": "2026-10-26T14:52:00.262Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:00.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99090 (GCVE-0-2026-99090)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:51 – Updated: 2026-10-26 14:51
VLAI
EPSS
VEX
Title
drm/amdgpu: serialize vblank counter reads against GPU reset
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: serialize vblank counter reads against GPU reset
The vblank counter callback reads display registers and scanout
position without holding reset_domain->sem. During GPU recovery,
display commit work can call the callback while reset owns the
semaphore for writing. The hardware access then triggers the
lockdep_assert_held() in amdgpu_device_skip_hw_access() and sets
TAINT_WARN when lockdep is enabled.
Try to acquire the reset semaphore for reading before accessing the
hardware, and hold it across the counter and scanout-position reads.
If reset is already in progress, return DRM's cached software vblank
count instead. This avoids blocking behind reset and avoids accessing
display hardware while it is being reset.
The cached count is less accurate than the hardware count, but is
used only when reset prevents a safe hardware read. This addresses
the reset-time warning from this vblank path; it does not suppress or
fix unrelated lockdep warnings.
(cherry picked from commit 51a4359f7431a4be5e42803c8bdaf7e0e5be2934)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 037796d9ca1da97978deaefd88ca5649f6cb69f5
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 11b6193c8841a052b7907006ffb1e02468b1448e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8d6f773d7479034a574ecc3b585bcd07d46b4824 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f4a0a1ce147d1a6e428d7cb5e3b99fd695139fc7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1a6023edfbb5673f55fab6348f135fb3b1428ea5 (git) Affected: 0 , < 6.6.160 (semver) Affected: 0 , < 6.12.113 (semver) Affected: 0 , < 6.18.57 (semver) Affected: 0 , < 7.2.11 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.160 , ≤ 6.6.*
(semver)
Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "037796d9ca1da97978deaefd88ca5649f6cb69f5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "11b6193c8841a052b7907006ffb1e02468b1448e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8d6f773d7479034a574ecc3b585bcd07d46b4824",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f4a0a1ce147d1a6e428d7cb5e3b99fd695139fc7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1a6023edfbb5673f55fab6348f135fb3b1428ea5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.57",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: serialize vblank counter reads against GPU reset\n\nThe vblank counter callback reads display registers and scanout\nposition without holding reset_domain-\u003esem. During GPU recovery,\ndisplay commit work can call the callback while reset owns the\nsemaphore for writing. The hardware access then triggers the\nlockdep_assert_held() in amdgpu_device_skip_hw_access() and sets\nTAINT_WARN when lockdep is enabled.\n\nTry to acquire the reset semaphore for reading before accessing the\nhardware, and hold it across the counter and scanout-position reads.\nIf reset is already in progress, return DRM\u0027s cached software vblank\ncount instead. This avoids blocking behind reset and avoids accessing\ndisplay hardware while it is being reset.\n\nThe cached count is less accurate than the hardware count, but is\nused only when reset prevents a safe hardware read. This addresses\nthe reset-time warning from this vblank path; it does not suppress or\nfix unrelated lockdep warnings.\n\n(cherry picked from commit 51a4359f7431a4be5e42803c8bdaf7e0e5be2934)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:51:59.654Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/037796d9ca1da97978deaefd88ca5649f6cb69f5"
},
{
"url": "https://git.kernel.org/stable/c/11b6193c8841a052b7907006ffb1e02468b1448e"
},
{
"url": "https://git.kernel.org/stable/c/8d6f773d7479034a574ecc3b585bcd07d46b4824"
},
{
"url": "https://git.kernel.org/stable/c/f4a0a1ce147d1a6e428d7cb5e3b99fd695139fc7"
},
{
"url": "https://git.kernel.org/stable/c/1a6023edfbb5673f55fab6348f135fb3b1428ea5"
}
],
"title": "drm/amdgpu: serialize vblank counter reads against GPU reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99090",
"datePublished": "2026-10-26T14:51:59.654Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:51:59.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99089 (GCVE-0-2026-99089)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:51 – Updated: 2026-10-26 14:51
VLAI
EPSS
VEX
Title
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
The probe function puts the device into the runtime PM active state with
only the "iis" bus clock enabled, but it also sets priv->op_clk to the
parent of the RCLK_SRC mux without enabling it. The runtime PM suspend
callback disables both clocks, so the first runtime suspend after probe
disables op_clk once more than it was enabled.
On Exynos5250 Arndale both clocks resolve to the same EXYNOS_I2S_BUS gate,
so this triggers the following warning during boot:
WARNING: drivers/clk/clk.c:1270 at clk_core_disable+0xe4/0x23c, CPU#0: kworker/u8:3/45
i2s_bus already disabled
...
Workqueue: pm pm_runtime_work
Call trace:
...
clk_core_disable from clk_disable+0x28/0x34
clk_disable from i2s_runtime_suspend+0x58/0x68 [snd_soc_i2s]
i2s_runtime_suspend [snd_soc_i2s] from genpd_runtime_suspend+0xc4/0x298
genpd_runtime_suspend from __rpm_callback+0x48/0x18c
__rpm_callback from rpm_callback+0x4c/0x50
rpm_callback from rpm_suspend+0xf4/0x718
rpm_suspend from pm_runtime_work+0x9c/0xa0
...
Fix this by enabling op_clk in probe right after getting it, so the clock
state matches the runtime PM active state, and by disabling it in remove.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
48279c53fd1d09dc0d1b6ebb9f21732c507cea0b , < 2c64c30d493d82d5edc95811cede0083e1195822
(git)
Affected: 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b , < 5dac6bf09b5a4fff2433629801309c3884c3e94a (git) Affected: 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b , < 64bb35079dcbc67901da1fe8c52c234cbcd17df3 (git) Affected: 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b , < a728c12f8bd89947894e227d0f4f83a895ac9ab7 (git) Affected: 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b , < 7529254014764ae0b8c33d5c61a58f36c65b1a1c (git) |
|
| Linux | Linux |
Affected:
4.17
Unaffected: 0 , < 4.17 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/samsung/i2s.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c64c30d493d82d5edc95811cede0083e1195822",
"status": "affected",
"version": "48279c53fd1d09dc0d1b6ebb9f21732c507cea0b",
"versionType": "git"
},
{
"lessThan": "5dac6bf09b5a4fff2433629801309c3884c3e94a",
"status": "affected",
"version": "48279c53fd1d09dc0d1b6ebb9f21732c507cea0b",
"versionType": "git"
},
{
"lessThan": "64bb35079dcbc67901da1fe8c52c234cbcd17df3",
"status": "affected",
"version": "48279c53fd1d09dc0d1b6ebb9f21732c507cea0b",
"versionType": "git"
},
{
"lessThan": "a728c12f8bd89947894e227d0f4f83a895ac9ab7",
"status": "affected",
"version": "48279c53fd1d09dc0d1b6ebb9f21732c507cea0b",
"versionType": "git"
},
{
"lessThan": "7529254014764ae0b8c33d5c61a58f36c65b1a1c",
"status": "affected",
"version": "48279c53fd1d09dc0d1b6ebb9f21732c507cea0b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/samsung/i2s.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: samsung: i2s: enable op_clk in probe to balance runtime PM\n\nThe probe function puts the device into the runtime PM active state with\nonly the \"iis\" bus clock enabled, but it also sets priv-\u003eop_clk to the\nparent of the RCLK_SRC mux without enabling it. The runtime PM suspend\ncallback disables both clocks, so the first runtime suspend after probe\ndisables op_clk once more than it was enabled.\n\nOn Exynos5250 Arndale both clocks resolve to the same EXYNOS_I2S_BUS gate,\nso this triggers the following warning during boot:\n\n WARNING: drivers/clk/clk.c:1270 at clk_core_disable+0xe4/0x23c, CPU#0: kworker/u8:3/45\n i2s_bus already disabled\n ...\n Workqueue: pm pm_runtime_work\n Call trace:\n ...\n clk_core_disable from clk_disable+0x28/0x34\n clk_disable from i2s_runtime_suspend+0x58/0x68 [snd_soc_i2s]\n i2s_runtime_suspend [snd_soc_i2s] from genpd_runtime_suspend+0xc4/0x298\n genpd_runtime_suspend from __rpm_callback+0x48/0x18c\n __rpm_callback from rpm_callback+0x4c/0x50\n rpm_callback from rpm_suspend+0xf4/0x718\n rpm_suspend from pm_runtime_work+0x9c/0xa0\n ...\n\nFix this by enabling op_clk in probe right after getting it, so the clock\nstate matches the runtime PM active state, and by disabling it in remove."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:51:59.055Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c64c30d493d82d5edc95811cede0083e1195822"
},
{
"url": "https://git.kernel.org/stable/c/5dac6bf09b5a4fff2433629801309c3884c3e94a"
},
{
"url": "https://git.kernel.org/stable/c/64bb35079dcbc67901da1fe8c52c234cbcd17df3"
},
{
"url": "https://git.kernel.org/stable/c/a728c12f8bd89947894e227d0f4f83a895ac9ab7"
},
{
"url": "https://git.kernel.org/stable/c/7529254014764ae0b8c33d5c61a58f36c65b1a1c"
}
],
"title": "ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99089",
"datePublished": "2026-10-26T14:51:59.055Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:51:59.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99088 (GCVE-0-2026-99088)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:51 – Updated: 2026-10-26 14:51
VLAI
EPSS
VEX
Title
net: openvswitch: validate transport header presence in set_ipv6_addr
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: validate transport header presence in set_ipv6_addr
When executing IPv6 address rewrite actions on IPv6 fragments,
set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()
processes a non-first IPv6 fragment, it sets key->ip.proto to
NEXTHDR_FRAGMENT and returns early without calling
skb_set_transport_header().
update_ipv6_checksum() unconditionally evaluates skb_transport_offset()
on entry before checking l4_proto. Because skb->transport_header is
uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although
it is completely harmless.
Fix this by returning early in update_ipv6_checksum() if l4_proto is
NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset
for fragments while preserving the debug warning for any other protocol
where the transport header is unexpectedly missing.
See the syzbot trace:
!skb_transport_header_was_set(skb)
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635
[...]
RIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]
RIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]
RIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]
RIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399
[...]
Call Trace:
<TASK>
set_ipv6 net/openvswitch/actions.c:531 [inline]
do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366
ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592
ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705
genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b , < b7b80d204abdc258006f9e17c92b363ab13bb599
(git)
Affected: 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b , < 6774af7cd17be8f0d0f70de3a749d381b4f2e9da (git) Affected: 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b , < 2594795fd832f0253826d64ff8976b8ff5fbfe9f (git) Affected: 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b , < 6b8897ba0733f88f0360ea48a970f373f9142de0 (git) Affected: 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b , < 3c6a4b11330fe424557538a98fca9f0a4c5bf313 (git) |
|
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7b80d204abdc258006f9e17c92b363ab13bb599",
"status": "affected",
"version": "3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b",
"versionType": "git"
},
{
"lessThan": "6774af7cd17be8f0d0f70de3a749d381b4f2e9da",
"status": "affected",
"version": "3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b",
"versionType": "git"
},
{
"lessThan": "2594795fd832f0253826d64ff8976b8ff5fbfe9f",
"status": "affected",
"version": "3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b",
"versionType": "git"
},
{
"lessThan": "6b8897ba0733f88f0360ea48a970f373f9142de0",
"status": "affected",
"version": "3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b",
"versionType": "git"
},
{
"lessThan": "3c6a4b11330fe424557538a98fca9f0a4c5bf313",
"status": "affected",
"version": "3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key-\u003eip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto. Because skb-\u003etransport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although\nit is completely harmless.\n\nFix this by returning early in update_ipv6_checksum() if l4_proto is\nNEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset\nfor fragments while preserving the debug warning for any other protocol\nwhere the transport header is unexpectedly missing.\n\nSee the syzbot trace:\n\n!skb_transport_header_was_set(skb)\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635\n[...]\nRIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]\nRIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]\nRIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]\nRIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399\n[...]\nCall Trace:\n \u003cTASK\u003e\n set_ipv6 net/openvswitch/actions.c:531 [inline]\n do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366\n ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592\n ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705\n genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114\n genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218\n netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:51:58.460Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7b80d204abdc258006f9e17c92b363ab13bb599"
},
{
"url": "https://git.kernel.org/stable/c/6774af7cd17be8f0d0f70de3a749d381b4f2e9da"
},
{
"url": "https://git.kernel.org/stable/c/2594795fd832f0253826d64ff8976b8ff5fbfe9f"
},
{
"url": "https://git.kernel.org/stable/c/6b8897ba0733f88f0360ea48a970f373f9142de0"
},
{
"url": "https://git.kernel.org/stable/c/3c6a4b11330fe424557538a98fca9f0a4c5bf313"
}
],
"title": "net: openvswitch: validate transport header presence in set_ipv6_addr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99088",
"datePublished": "2026-10-26T14:51:58.460Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:51:58.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99087 (GCVE-0-2026-99087)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the
user activates the device in the 'R' mode, a crash in dm_integrity_resume
happens because the function attempts to read the journal containing the
bitmap.
This patch makes dm-integrity skip any writes to the device in
dm_integrity_resume if the device is activated in the 'R' mode.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 2e25842f0e4423e0efb243f56153d842ed6b933f
(git)
Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 69ed43ed8a174465fca1ba6bfbde53e4618c8956 (git) Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2e25842f0e4423e0efb243f56153d842ed6b933f",
"status": "affected",
"version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
"versionType": "git"
},
{
"lessThan": "69ed43ed8a174465fca1ba6bfbde53e4618c8956",
"status": "affected",
"version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
"versionType": "git"
},
{
"lessThan": "7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84",
"status": "affected",
"version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the \u0027R\u0027 mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the \u0027R\u0027 mode."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:05.714Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f"
},
{
"url": "https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956"
},
{
"url": "https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"
}
],
"title": "dm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99087",
"datePublished": "2026-10-23T12:45:05.714Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:05.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99086 (GCVE-0-2026-99086)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
dm-integrity: validate the superblock on resume
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: validate the superblock on resume
dm_integrity_resume() re-reads the superblock from the device so that it
picks up the flags and the recalculate position. It performs no
validation on the result, while the constructor validates the superblock
it reads and sizes all the in-memory structures according to it. The user
may modify the superblock on the underlying device while the dm-integrity
device is suspended, so that the two no longer agree.
In particular, access_journal_data() shifts the journal entry index by
ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the
journal page list were computed with the value that was present at
constructor time. Increasing log2_sectors_per_block makes the index run
past the end of the journal, and dm-integrity then writes 512 bytes
through lowmem_page_address(NULL).
Snapshot the validated superblock in the constructor and refuse to resume
if any of the fields that describe the on-disk geometry changed.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
38625191f32f77a9d5fc7cc15f4f9b78768bfb33 , < 454b67fcc28c18502e47dfb9f067b04c28628ada
(git)
Affected: 118ba36e446c01e3cd34b3eedabf1d9436525e1d , < e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e (git) Affected: 118ba36e446c01e3cd34b3eedabf1d9436525e1d , < fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2 (git) Affected: 824b9c27d7b600520b95f0cab95a47d1b08a9483 (git) Affected: fb49f209995f729053c6ee728436f98d78a49b6f (git) Affected: c6138af1f5454c2631a837916fda958ea72c0d71 (git) Affected: 3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f (git) Affected: 6.18.16 , < 6.18.58 (semver) Affected: 6.1.165 , < 6.2 (semver) Affected: 6.6.128 , < 6.7 (semver) Affected: 6.12.75 , < 6.13 (semver) Affected: 6.19.6 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "454b67fcc28c18502e47dfb9f067b04c28628ada",
"status": "affected",
"version": "38625191f32f77a9d5fc7cc15f4f9b78768bfb33",
"versionType": "git"
},
{
"lessThan": "e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e",
"status": "affected",
"version": "118ba36e446c01e3cd34b3eedabf1d9436525e1d",
"versionType": "git"
},
{
"lessThan": "fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2",
"status": "affected",
"version": "118ba36e446c01e3cd34b3eedabf1d9436525e1d",
"versionType": "git"
},
{
"status": "affected",
"version": "824b9c27d7b600520b95f0cab95a47d1b08a9483",
"versionType": "git"
},
{
"status": "affected",
"version": "fb49f209995f729053c6ee728436f98d78a49b6f",
"versionType": "git"
},
{
"status": "affected",
"version": "c6138af1f5454c2631a837916fda958ea72c0d71",
"versionType": "git"
},
{
"status": "affected",
"version": "3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f",
"versionType": "git"
},
{
"lessThan": "6.18.58",
"status": "affected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.18.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.165",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic-\u003esb-\u003elog2_sectors_per_block, while ic-\u003ejournal_section_sectors and the\njournal page list were computed with the value that was present at\nconstructor time. Increasing log2_sectors_per_block makes the index run\npast the end of the journal, and dm-integrity then writes 512 bytes\nthrough lowmem_page_address(NULL).\n\nSnapshot the validated superblock in the constructor and refuse to resume\nif any of the fields that describe the on-disk geometry changed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:04.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada"
},
{
"url": "https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e"
},
{
"url": "https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"
}
],
"title": "dm-integrity: validate the superblock on resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99086",
"datePublished": "2026-10-23T12:45:04.496Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:04.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99085 (GCVE-0-2026-99085)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
A CPU going down has to empty its own rq. Its hotplug thread waits in
sched_cpu_wait_empty() until nothing else is left, and the only thing that
wakes it is balance_push(), which runs from __schedule() on the dying CPU
and pushes off the migratable tasks the CPU picks.
sched_ext breaks this. A task sitting on a user DSQ or held by the BPF
scheduler is still counted on its rq, but an inactive CPU no longer calls
ops.dispatch() and can't pull the task back. The dying CPU goes idle with
the task still counted, and one of two things happens:
- Another CPU consumes the task. The rq empties without a __schedule() on
the dying CPU, so the hotplug thread is never woken and cpu_down() hangs
holding cpu_hotplug_lock.
- The task is affine only to the dying CPU. Nothing can move it, and the
offline stalls until the watchdog ejects the BPF scheduler.
When the rq goes offline, re-enqueue every task on it that isn't already on
the local DSQ. An enqueue on an offline rq lands on the local DSQ, so the
dying CPU itself picks the tasks and balance_push() pushes them off, the
same as for the other sched classes. From then on no sched_ext path on
another CPU can pull a task off the rq.
ops.dispatch() currently stops as soon as the CPU goes inactive, and CPU
hotplug then waits for an RCU grace period before taking the rq offline. A
BPF-held task affine only to the dying CPU and preempted inside an RCU
read-side critical section would block that grace period, and the rq would
never go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps
running until the rq goes offline. Only the dying CPU's own hotplug thread
clears the flag during teardown, and task_can_run_on_remote_rq() still keeps
other rqs' tasks off the CPU.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f0e1a0643a59bf1f922fa209cec86a170b784f3f , < f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c
(git)
Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < 638ee6bca19750934ea13f9c325f46fd8ae60064 (git) Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < 173ff9d03ec6373c3158b6e630af33a9b36fd216 (git) Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < d35a535d3e3e71f92a051d94e415f43612c4edfc (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "638ee6bca19750934ea13f9c325f46fd8ae60064",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "173ff9d03ec6373c3158b6e630af33a9b36fd216",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "d35a535d3e3e71f92a051d94e415f43612c4edfc",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix CPU hotplug hang when a dying CPU\u0027s tasks sit in the BPF scheduler\n\nA CPU going down has to empty its own rq. Its hotplug thread waits in\nsched_cpu_wait_empty() until nothing else is left, and the only thing that\nwakes it is balance_push(), which runs from __schedule() on the dying CPU\nand pushes off the migratable tasks the CPU picks.\n\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPF\nscheduler is still counted on its rq, but an inactive CPU no longer calls\nops.dispatch() and can\u0027t pull the task back. The dying CPU goes idle with\nthe task still counted, and one of two things happens:\n\n- Another CPU consumes the task. The rq empties without a __schedule() on\n the dying CPU, so the hotplug thread is never woken and cpu_down() hangs\n holding cpu_hotplug_lock.\n- The task is affine only to the dying CPU. Nothing can move it, and the\n offline stalls until the watchdog ejects the BPF scheduler.\n\nWhen the rq goes offline, re-enqueue every task on it that isn\u0027t already on\nthe local DSQ. An enqueue on an offline rq lands on the local DSQ, so the\ndying CPU itself picks the tasks and balance_push() pushes them off, the\nsame as for the other sched classes. From then on no sched_ext path on\nanother CPU can pull a task off the rq.\n\nops.dispatch() currently stops as soon as the CPU goes inactive, and CPU\nhotplug then waits for an RCU grace period before taking the rq offline. A\nBPF-held task affine only to the dying CPU and preempted inside an RCU\nread-side critical section would block that grace period, and the rq would\nnever go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps\nrunning until the rq goes offline. Only the dying CPU\u0027s own hotplug thread\nclears the flag during teardown, and task_can_run_on_remote_rq() still keeps\nother rqs\u0027 tasks off the CPU."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:03.465Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c"
},
{
"url": "https://git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064"
},
{
"url": "https://git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216"
},
{
"url": "https://git.kernel.org/stable/c/d35a535d3e3e71f92a051d94e415f43612c4edfc"
}
],
"title": "sched_ext: Fix CPU hotplug hang when a dying CPU\u0027s tasks sit in the BPF scheduler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99085",
"datePublished": "2026-10-23T12:45:03.465Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:03.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99084 (GCVE-0-2026-99084)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
readdir: take no inode lock on an immutable directory
Summary
In the Linux kernel, the following vulnerability has been resolved:
readdir: take no inode lock on an immutable directory
iterate_dir() takes the directory's i_rwsem shared and holds it across
->iterate_shared(). For a directory that never has an entry and is
never removed the lock keeps nothing still, it only orders every reader
and every writer of that inode behind each other.
For the directory of a nullfs instance that matters. The instance of
the initial mount namespace is the root of every empty mount namespace
and the private instance is the root of every kernel thread, so one
inode is shared across users who have nothing else in common. And a
reader can hold the lock for as long as it likes: back the getdents()
buffer with a mapping of a file on a FUSE mount of your own, let the
copy of "." and ".." fault and let the server wait. Queue an exclusive
taker behind it, a mkdir() in that directory goes through start_dirop()
before the read-only mount is reported, and from then on every lookup
that misses the dcache in that directory, every create and every mount
on it waits until the server answers. One user of an empty mount
namespace stalls all the others.
Add FOP_IMMUTABLE for the file operations of a directory that never
changes and is never removed and let iterate_dir() skip the lock for
it. The flag never changes for a file, ->f_pos is protected by
f_pos_lock since directories are FMODE_ATOMIC_POS, IS_DEADDIR can't be
set on such a directory and neither touch_atime() nor fsnotify take
i_rwsem. Set it on the nullfs directory. The placeholder directories of
libfs never have an entry either but their owners remove them, so they
keep the lock.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9d4e752a24f740b31ca827bfab07010e4e7f34b0 , < 6d30b399ae28e5166d62484f81ccaefde6fe7996
(git)
Affected: 9d4e752a24f740b31ca827bfab07010e4e7f34b0 , < e08f57a7dcb83818c058e415988c23beb6c5a47f (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nullfs.c",
"fs/readdir.c",
"include/linux/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d30b399ae28e5166d62484f81ccaefde6fe7996",
"status": "affected",
"version": "9d4e752a24f740b31ca827bfab07010e4e7f34b0",
"versionType": "git"
},
{
"lessThan": "e08f57a7dcb83818c058e415988c23beb6c5a47f",
"status": "affected",
"version": "9d4e752a24f740b31ca827bfab07010e4e7f34b0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nullfs.c",
"fs/readdir.c",
"include/linux/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nreaddir: take no inode lock on an immutable directory\n\niterate_dir() takes the directory\u0027s i_rwsem shared and holds it across\n-\u003eiterate_shared(). For a directory that never has an entry and is\nnever removed the lock keeps nothing still, it only orders every reader\nand every writer of that inode behind each other.\n\nFor the directory of a nullfs instance that matters. The instance of\nthe initial mount namespace is the root of every empty mount namespace\nand the private instance is the root of every kernel thread, so one\ninode is shared across users who have nothing else in common. And a\nreader can hold the lock for as long as it likes: back the getdents()\nbuffer with a mapping of a file on a FUSE mount of your own, let the\ncopy of \".\" and \"..\" fault and let the server wait. Queue an exclusive\ntaker behind it, a mkdir() in that directory goes through start_dirop()\nbefore the read-only mount is reported, and from then on every lookup\nthat misses the dcache in that directory, every create and every mount\non it waits until the server answers. One user of an empty mount\nnamespace stalls all the others.\n\nAdd FOP_IMMUTABLE for the file operations of a directory that never\nchanges and is never removed and let iterate_dir() skip the lock for\nit. The flag never changes for a file, -\u003ef_pos is protected by\nf_pos_lock since directories are FMODE_ATOMIC_POS, IS_DEADDIR can\u0027t be\nset on such a directory and neither touch_atime() nor fsnotify take\ni_rwsem. Set it on the nullfs directory. The placeholder directories of\nlibfs never have an entry either but their owners remove them, so they\nkeep the lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:02.631Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d30b399ae28e5166d62484f81ccaefde6fe7996"
},
{
"url": "https://git.kernel.org/stable/c/e08f57a7dcb83818c058e415988c23beb6c5a47f"
}
],
"title": "readdir: take no inode lock on an immutable directory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99084",
"datePublished": "2026-10-23T12:45:02.631Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:02.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99083 (GCVE-0-2026-99083)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-26 06:56
VLAI
EPSS
VEX
Title
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 , < 59c6dcc5dd9dafe764ca0d40525933b2be69b059
(git)
Affected: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 , < 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a (git) Affected: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 , < 517404e157395d0f8da125ca956c566895dfcd06 (git) Affected: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 , < 4722d06b2907585074252061b1024a696c1cfc23 (git) Affected: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 , < 23a0be6a84a38ac169eeab49017934e8e27c65f0 (git) Affected: 676392184785ace61e939831e7ca44a03d438c3b (git) Affected: ef572ffa8eb44111eed2925fbb2adca78bdcbf61 (git) Affected: 2ba03cecb12ac7ac9e0170e251543c56832d9959 (git) Affected: 5.15.145 , < 5.16 (semver) Affected: 6.1.40 , < 6.2 (semver) Affected: 6.4.5 , < 6.5 (semver) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59c6dcc5dd9dafe764ca0d40525933b2be69b059",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "517404e157395d0f8da125ca956c566895dfcd06",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "4722d06b2907585074252061b1024a696c1cfc23",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "23a0be6a84a38ac169eeab49017934e8e27c65f0",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"status": "affected",
"version": "676392184785ace61e939831e7ca44a03d438c3b",
"versionType": "git"
},
{
"status": "affected",
"version": "ef572ffa8eb44111eed2925fbb2adca78bdcbf61",
"versionType": "git"
},
{
"status": "affected",
"version": "2ba03cecb12ac7ac9e0170e251543c56832d9959",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.40",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work-\u003enext_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len \u003c= resp-\u003espnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work-\u003enext_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ksmbd_conn_handler_loop() receives the compound request over TCP/445, and __process_request() dispatches its non-first SMB2 SESSION_SETUP to smb2_sess_setup() and krb5_authenticate(). The SESSION_SETUP SecurityBuffer carries the Kerberos AP-REQ that produces the AP-REP copied by the patched path.\nAC:L - The same authenticated peer can create directory entries, request a sized QUERY_DIRECTORY response, and place SESSION_SETUP later in the compound, controlling next_smb2_rsp_hdr_off before supplying its valid AP-REQ; no race or external actor is required.\nPR:L - ksmbd_krb5_authenticate() checks KSMBD_USER_FLAG_OK before its length check and memcpy; ksmbd.mountd sets it only after krb5_rd_req() accepts the AP-REQ and usm_handle_login_request() recognizes the account. An ordinary valid Kerberos account suffices, but an unauthenticated peer cannot reach the write.\nUI:N - The peer opens the session, prepares the prior compound response, and sends the Kerberos SESSION_SETUP itself; no victim user must open, mount, or approve anything.\nS:U - ksmbd_krb5_authenticate() corrupts memory adjacent to the host kernel\u0027s response_buf allocation; this remains within the same kernel security authority and crosses no VM, IOMMU, or sandbox boundary.\nC:H - The AP-REP memcpy in ksmbd_krb5_authenticate() can overrun response_buf and corrupt adjacent heap objects; exploitable kernel heap corruption can be converted into a memory-read primitive exposing arbitrary kernel data.\nI:H - The memcpy writes resp-\u003espnego_blob_len AP-REP bytes beyond response_buf into adjacent kernel heap memory, enabling corruption of object metadata or control data and potential kernel code execution.\nA:H - Writing the AP-REP beyond response_buf can corrupt adjacent allocations or allocator metadata and trigger KASAN, an oops, or a kernel panic; the authenticated SMB peer can repeat the compound request."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T06:56:58.783Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059"
},
{
"url": "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a"
},
{
"url": "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"
},
{
"url": "https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23"
},
{
"url": "https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0"
}
],
"title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99083",
"datePublished": "2026-10-23T12:45:01.735Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T06:56:58.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99082 (GCVE-0-2026-99082)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-24 14:10
VLAI
EPSS
VEX
Title
KVM: x86: Use active memslots for the per-vCPU MMIO cache
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use active memslots for the per-vCPU MMIO cache
KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information. Both the fill and
validation paths use kvm_memslots(), which unconditionally selects address
space 0, even when the vCPU is running in SMM and using address space 1.
Commit 56f17dd3fbc4 ("kvm: x86: fix stale mmio cache bug") added the
memslot generation to the cache key so that a memslot update could not
leave a stale entry valid. When commit 699023e23965 ("KVM: x86: add SMM
to the MMU role, support SMRAM address space") added the SMM address space,
these helpers were not converted to use the active memslots.
Consequently, an update to the SMM memslots can leave an entry from the old
SMM address space apparently valid after the vCPU returns to the normal
address space. A guest can then cause an access to valid RAM at the same
GFN to be returned to userspace as KVM_EXIT_MMIO.
Completing that exit through the VMM's RAM address space writes the backing
page without going through KVM's write-tracking path. If the page backs a
nested EPT table, KVM can continue using shadow translations derived from
the old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()
catches this invalid cache and memslot combination.
Use the vCPU's active memslots when caching and validating the entry.
Memslot generations are unique across address spaces, so the generation
also distinguishes the normal and SMM views. This matches the MMIO SPTE
cache, which already uses kvm_vcpu_memslots().
On an unpatched current-mainline kernel, a regression test that fills the
cache in SMM and updates only the SMM memslots fails the intended RAM write
and triggers the kvm_mmu_write_protect_fault() warning. With this change,
the same test completes the RAM write without a warning. The x86/smm_test,
set_memory_region_test, and memslot_modification_stress_test selftests also
pass.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
699023e239658e62da6f42f47d31b54788521ec1 , < a63f79d9da9468952396af73e1e53330845cf876
(git)
Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 2566780c684c9c21241d409d790087c73070f312 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < e792a9ace39d2812a5b342a1987186c7bc653204 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < b3e6212dea2e4328a841ceb37f377583176dc735 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a63f79d9da9468952396af73e1e53330845cf876",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "2566780c684c9c21241d409d790087c73070f312",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "e792a9ace39d2812a5b342a1987186c7bc653204",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "b3e6212dea2e4328a841ceb37f377583176dc735",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information. Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid. When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space. A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM\u0027s RAM address space writes the backing\npage without going through KVM\u0027s write-tracking path. If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU\u0027s active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views. This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning. With this change,\nthe same test completes the RAM write without a warning. The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker drives guest memory accesses through KVM_RUN via kvm_vcpu_ioctl()-\u003ekvm_arch_vcpu_ioctl_run()-\u003ehandle_ept_violation()/handle_ept_misconfig()-\u003ekvm_mmu_page_fault(), reaching the patched MMIO-cache helpers; no network protocol carries the input.\nAC:L - A malicious L1 can deterministically enter SMM, fault on an unmapped GFN to fill the cache, alter Q35 SMRAM mappings, execute RSM, and write the same GFN; this requires no race, and the complete sequence was reproduced with nested VMX/EPT.\nPR:L - The demonstrated escape needs kernel-level control of the L1 guest to manage SMM and EPT12, but that is tenant-granted guest privilege relative to host KVM; neither kvm_mmu_page_fault() nor vcpu_match_mmio_gen() requires host administrative capability.\nUI:N - The malicious L1 performs the SMM access, Q35 SMRAM reconfiguration, RSM, nested-EPT update, and final RAM write itself, without any action by a host user or administrator.\nS:C - The flaw originates in host KVM\u0027s per-vCPU MMIO cache, while stale shadow EPT translations permit the guest to access host kernel memory, crossing the guest-to-host virtualization boundary.\nC:H - Bypassing kvm_page_track_write() leaves EPT02 translations derived from old EPT12 contents; on affected Linux 6.1.74 this exact stale mapping was demonstrated to provide arbitrary reads of host physical and kernel memory.\nI:H - The same stale EPT02 translations were demonstrated to provide arbitrary host-memory writes and host-kernel code execution after emulator_write_emulated() incorrectly routed the tracked EPT12 write through KVM_EXIT_MMIO.\nA:H - Arbitrary host-kernel writes and code execution can crash the host and all co-resident VMs; independently, the invalid cache state reaches WARN_ON_ONCE() in kvm_mmu_write_protect_fault(), which panics hardened panic_on_warn hosts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:10:23.875Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876"
},
{
"url": "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd"
},
{
"url": "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"
},
{
"url": "https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204"
},
{
"url": "https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735"
}
],
"title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99082",
"datePublished": "2026-10-23T12:45:00.798Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-24T14:10:23.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99081 (GCVE-0-2026-99081)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-24 14:10
VLAI
EPSS
VEX
Title
bnxt_en: fix DMA mapping length for padded small packets
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: fix DMA mapping length for padded small packets
Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:
DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
[fault reason 0x06] PTE Read access is not set
bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
...
NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out
The fault address (0xfc499000) is on an exact 4KB page boundary,
pointing to a DMA read buffer overrun.
In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),
such as 42-byte untagged ARP frames, are padded:
if (length < BNXT_MIN_PKT_SIZE) {
pad = BNXT_MIN_PKT_SIZE - length;
if (skb_pad(skb, pad))
goto tx_kick_pending;
length = BNXT_MIN_PKT_SIZE;
}
mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
...
dma_unmap_len_set(tx_buf, len, len);
However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)
and is left unadjusted after padding. Consequently, dma_map_single() and
dma_unmap_len_set() map and track only 42 bytes.
Later, the hardware TX buffer descriptor is programmed with the padded length:
txbd->tx_bd_len_flags_type =
cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
TX_BD_FLAGS_PACKET_END);
The NIC DMA engine is thus instructed to read 52 bytes from a region where
only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB
page (within 'pad' bytes of the next page), the hardware DMA read overruns
into the unmapped adjacent page, triggering an IOMMU fault.
This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic
and races when toggling HW VLAN offload") because reserving extra VLAN
headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data
offsets and potentially causing small frames to land right against page
boundaries.
Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in
bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,
because padding might linearize the skb.
This ensures skb->len and skb_headlen(skb) reflect the padded size so
that dma_map_single() maps the full buffer and the descriptor length is
consistent. This also removes the temporary 'pad' variable and masking logic.
The padding is done after the SW USO branch, otherwise
bnxt_sw_udp_gso_xmit() would account the padding as UDP payload
and send it in extra segments.
Note that SW USO segments are still not padded: with IPv4, a segment
carrying less than 10 bytes of UDP payload (small gso_size, or a short
last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.
This is a separate issue, left for a followup patch.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c0c050c58d840994ba842ad1c338a98e7c12b764 , < cf8530a25ae92c4493e2f22981ecb46f0b66f4c8
(git)
Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < 2956aca14dd2977cd08bd2ccafae3beb8b84b268 (git) Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < fbd977e513971ccb4f0762a7f59eac500e474f89 (git) Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < 5213f65a9667d3dd85db2e6df8f2e0516290db34 (git) Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < a51d233ccd4889aadb71dace863525cc2b00271e (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf8530a25ae92c4493e2f22981ecb46f0b66f4c8",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "2956aca14dd2977cd08bd2ccafae3beb8b84b268",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "fbd977e513971ccb4f0762a7f59eac500e474f89",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "5213f65a9667d3dd85db2e6df8f2e0516290db34",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "a51d233ccd4889aadb71dace863525cc2b00271e",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n [fault reason 0x06] PTE Read access is not set\n bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n ...\n NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n if (length \u003c BNXT_MIN_PKT_SIZE) {\n pad = BNXT_MIN_PKT_SIZE - length;\n if (skb_pad(skb, pad))\n goto tx_kick_pending;\n length = BNXT_MIN_PKT_SIZE;\n }\n\n mapping = dma_map_single(\u0026pdev-\u003edev, skb-\u003edata, len, DMA_TO_DEVICE);\n ...\n dma_unmap_len_set(tx_buf, len, len);\n\nHowever, \u0027len\u0027 was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n txbd-\u003etx_bd_len_flags_type =\n cpu_to_le32(((len + pad) \u003c\u003c TX_BD_LEN_SHIFT) | flags |\n TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb-\u003edata ends near the boundary of a 4KB\npage (within \u0027pad\u0027 bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb-\u003edata\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)-\u003enr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb-\u003elen and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary \u0027pad\u0027 variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A minimal IPv4 ICMP Echo Request follows bnxt_poll\u2192bnxt_rx_pkt\u2192icmp_rcv\u2192icmp_echo; icmp_reply builds a 42-byte reply that reaches the patched bnxt_start_xmit through ip_finish_output2\u2192dev_queue_xmit, including vlan_dev_hard_start_xmit on the reported VLAN setup.\nAC:L - A request burst keeps the TX ring nonempty, bypassing the push fast path and repeatedly exercising the 42-to-52-byte mismatch; repeated skb allocations provide the documented 4-KiB boundary placement without a race, second actor, or hardware failure.\nPR:N - icmp_rcv and icmp_echo process the Echo Request and invoke icmp_reply without socket credentials, capability checks, or authentication, so the remote sender needs no account or privileges.\nUI:N - Receipt of the ICMP Echo Request automatically constructs and transmits the short reply through bnxt_start_xmit; no victim must open a file, run a command, or otherwise act.\nS:U - bnxt_start_xmit misprograms the host NIC\u0027s TX DMA length, but the IOMMU rejects the overrun rather than being bypassed; no guest, sandbox, or other security authority is crossed.\nC:N - skb_pad zero-fills the intended ten padding bytes, while the demonstrated access reaches an unmapped IOVA page and faults; the code provides no path that returns host memory to the routed ICMP peer.\nI:N - The erroneous operation is a DMA_TO_DEVICE read of up to ten bytes beyond the mapping; it neither authorizes a NIC write into host memory nor modifies kernel data.\nA:H - The 52-byte descriptor read from a 42-byte mapping causes the documented IOMMU fault and NETDEV WATCHDOG TX-queue timeout; bnxt_tx_timeout then schedules bnxt_reset_task to close and reopen the NIC, and repeated requests can continually disrupt all interface traffic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:10:22.790Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8"
},
{
"url": "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268"
},
{
"url": "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"
},
{
"url": "https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34"
},
{
"url": "https://git.kernel.org/stable/c/a51d233ccd4889aadb71dace863525cc2b00271e"
}
],
"title": "bnxt_en: fix DMA mapping length for padded small packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99081",
"datePublished": "2026-10-23T12:23:28.347Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-24T14:10:22.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99080 (GCVE-0-2026-99080)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-26 06:56
VLAI
EPSS
VEX
Title
fs: Free any excess xarray nodes in clear_inode()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs: Free any excess xarray nodes in clear_inode()
For many years we've had a hard to hit leak of xarray nodes. Hugh
documented it well in commit 786b31121a2c. Recently people and
syzbot have found ways to force it to happen with madvise. Rather
than fix the leaks where they happen, just call xa_destroy() which
has the side-effect of cycling the i_pages lock.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
77da9389b9d5f07d54fda092d1ab56002ec0019a , < f1c966eb6ed5e190c90a56c5bdaa69967de39f21
(git)
Affected: 77da9389b9d5f07d54fda092d1ab56002ec0019a , < 21f51434c47d8628b62275ae6c6ad6b573abcd02 (git) Affected: 77da9389b9d5f07d54fda092d1ab56002ec0019a , < 50cff3f112d64db6e5f57355f79bc837db8fe132 (git) Affected: 77da9389b9d5f07d54fda092d1ab56002ec0019a , < 43f830e2bb84b22ca824b20bb861d823ecb520bd (git) Affected: 77da9389b9d5f07d54fda092d1ab56002ec0019a , < ee3f011250104129893d8e9599147e457d4d7280 (git) |
|
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1c966eb6ed5e190c90a56c5bdaa69967de39f21",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "21f51434c47d8628b62275ae6c6ad6b573abcd02",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "50cff3f112d64db6e5f57355f79bc837db8fe132",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "43f830e2bb84b22ca824b20bb861d823ecb520bd",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
},
{
"lessThan": "ee3f011250104129893d8e9599147e457d4d7280",
"status": "affected",
"version": "77da9389b9d5f07d54fda092d1ab56002ec0019a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we\u0027ve had a hard to hit leak of xarray nodes. Hugh\ndocumented it well in commit 786b31121a2c. Recently people and\nsyzbot have found ways to force it to happen with madvise. Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T06:56:57.576Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21"
},
{
"url": "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02"
},
{
"url": "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"
},
{
"url": "https://git.kernel.org/stable/c/43f830e2bb84b22ca824b20bb861d823ecb520bd"
},
{
"url": "https://git.kernel.org/stable/c/ee3f011250104129893d8e9599147e457d4d7280"
}
],
"title": "fs: Free any excess xarray nodes in clear_inode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99080",
"datePublished": "2026-10-23T12:23:27.393Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T06:56:57.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99079 (GCVE-0-2026-99079)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-24 14:10
VLAI
EPSS
VEX
Title
net/mlx5e: Prevent stale XSK buffer release on refill retry
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on refill retry
When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the subsequent batched refill
of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before
allocating a replacement. If that refill succeeds only partially, a WQE
left without a replacement retains its old buffer pointer.
The buffer can meanwhile be allocated to another WQE. A later refill
retry can then free the live buffer through the stale pointer and publish
the same UMEM frame twice.
Mark the WQE as released immediately after the driver-side free. The flag
is already cleared when a replacement buffer is assigned, so refill
retries no longer release stale pointers.
The failure is silent and produces no kernel warning or splat. A
standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP
traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914
packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64
ownership/double-publication errors. With this change it processed
356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,
with no ownership or data errors.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 32bbb870078d467479965c21bbc4960c57eea208
(git)
Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 34d1db2b18e1c1d189e34dd51923e031815f88e3 (git) Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 639522e5056cade578a324acfa993ec6c9f7f5dc (git) Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 655f47477054d19de3b138840be229a1a4490d0c (git) Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < e01620844c5c88b6fcf819d171df8e3976a0e76f (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "32bbb870078d467479965c21bbc4960c57eea208",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "34d1db2b18e1c1d189e34dd51923e031815f88e3",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "639522e5056cade578a324acfa993ec6c9f7f5dc",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "655f47477054d19de3b138840be229a1a4490d0c",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "e01620844c5c88b6fcf819d171df8e3976a0e76f",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE\u0027s XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - UDP datagrams reaching mlx5 drive mlx5e_completion_event() -\u003e mlx5e_napi_poll() -\u003e mlx5e_poll_rx_cq()/XDP redirect, then mlx5e_napi_xsk_post() -\u003e mlx5e_post_rx_wqes() -\u003e patched mlx5e_xsk_free_rx_wqe(); sustained routable traffic fills the XSK RX ring and triggers stale release.\nAC:L - A sender can sustain small-packet traffic until __xsk_rcv_zc() reports RX-ring-full and mlx5e_xsk_alloc_rx_wqes_batched() refills only part of the missing WQEs; retries are deterministic and require no uncontrolled race or memory layout.\nPR:N - The NIC-CQE/NAPI receive path contains no capability or authentication check; xsk_create()\u0027s CAP_NET_RAW check applies to victim-side AF_XDP provisioning, while the remote UDP sender needs no privileges.\nUI:N - Once the zero-copy XSK pool and XDP redirect are active, xsk_rcv_zc() failure, mlx5e_napi_xsk_post(), and refill retries occur automatically as packets arrive, without further victim action.\nS:U - mlx5e_xsk_free_rx_wqe() corrupts the host kernel\u0027s xsk_buff_pool and mlx5 receive state without crossing a VM, IOMMU, or other security-authority boundary.\nC:H - Duplicate xdp_buff_xsk ownership lets repeated successful __xsk_rcv_zc() calls invoke unbounded xp_release(); in unaligned-UMEM mode, free_heads_cnt can write kernel pointers past the flexible free_heads[] array, yielding heap corruption exploitable for arbitrary disclosure.\nI:H - The duplicate WQEs can make xp_release() write beyond free_heads[], while xp_get_xskb() later trusts pointers popped through the corrupted count; this supplies out-of-bounds and corrupted-pointer write primitives capable of control-flow hijacking.\nA:H - The free_heads[] overflow or a bogus xskb consumed by xp_get_xskb() can oops or panic; additionally, the dma_dev_need_sync refill path can store NULL on allocation failure and have the stale retry pass it to xsk_buff_free()."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:10:21.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208"
},
{
"url": "https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3"
},
{
"url": "https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc"
},
{
"url": "https://git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c"
},
{
"url": "https://git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f"
}
],
"title": "net/mlx5e: Prevent stale XSK buffer release on refill retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99079",
"datePublished": "2026-10-23T12:23:26.458Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-24T14:10:21.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99078 (GCVE-0-2026-99078)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-24 14:10
VLAI
EPSS
VEX
Title
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.
mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.
Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.
Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4c2a1323680709078736a2886c754004e9fe42e6 , < f3a52e2ec2788a7f6b64137985c087188a54ad4f
(git)
Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < d215d09606b0fcd18ad1eb532995782a21cea49d (git) Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < 867119b4b588037724b85839d534465f0334d9bd (git) Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < 3d73a1164a8c6b4461907a65cb6c022ea4fd39af (git) Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < 63811edf512584c946e5e96b100e9e280703bbb5 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3a52e2ec2788a7f6b64137985c087188a54ad4f",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "d215d09606b0fcd18ad1eb532995782a21cea49d",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "867119b4b588037724b85839d534465f0334d9bd",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "3d73a1164a8c6b4461907a65cb6c022ea4fd39af",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "63811edf512584c946e5e96b100e9e280703bbb5",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Routable IP packets received by mlx5 consume the AF_XDP striding RQ through mlx5e_completion_event() -\u003e mlx5e_napi_poll() -\u003e mlx5e_poll_rx_cq(), after which mlx5e_napi_xsk_post() -\u003e mlx5e_post_rx_mpwqes() reaches patched mlx5e_xsk_alloc_rx_mpwqe(); packet pressure exhausts the RX/Fill rings and triggers the stale-buffer retry.\nAC:L - A sender can flood the XSK-bound RSS queue until XDP redirect and refill allocation fail, then continue traffic so NAPI retries the unchanged actual_wq_head; no uncontrolled race is needed for mlx5e_free_rx_mpwqe() to release the stale pointer.\nPR:N - The receive path beginning at mlx5e_completion_event() performs no authentication or capability check; xsk_create()\u0027s CAP_NET_RAW requirement applies to victim-side AF_XDP provisioning, while the remote IP sender needs no privileges.\nUI:N - Once an mlx5 AF_XDP zero-copy pool and XDP program are running, packet receipt, mlx5e_napi_xsk_post(), and the refill retries occur automatically without further victim action.\nS:U - The corrupted xsk_buff_pool metadata and mlx5 receive state belong to the host kernel; the bug crosses no VM, IOMMU, or other security-authority boundary.\nC:H - In unaligned-UMEM mode, duplicate live xdp_buff_xsk ownership lets repeated successful __xsk_rcv_zc() calls make xp_release() write kernel pointers past the pool\u0027s flexible free_heads[] array; this heap corruption can be leveraged to disclose arbitrary kernel memory.\nI:H - The same xp_release() overflow is an out-of-bounds kernel heap write; subsequent xp_get_xskb() trusts pointers popped from corrupted free_heads[] and initializes through them, supporting arbitrary writes or control-flow corruption.\nA:H - Overflowing free_heads[] or later dereferencing a bogus xskb in xp_get_xskb() can oops or panic; even without a crash, duplicate UMEM ownership can prevent mlx5e_xsk_alloc_rx_mpwqe() from restoring WQEs and stop the bound receive queue."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:10:20.145Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f"
},
{
"url": "https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d"
},
{
"url": "https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd"
},
{
"url": "https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af"
},
{
"url": "https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5"
}
],
"title": "net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99078",
"datePublished": "2026-10-23T12:23:25.542Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-24T14:10:20.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99077 (GCVE-0-2026-99077)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-26 15:13
VLAI
EPSS
VEX
Title
ipv4: udp: Create exceptions before socket matching
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: udp: Create exceptions before socket matching
Currently, when ICMP Fragmentation Needed and Redirect Message packets
are locally delivered and quote a UDP packet, a FIB nexthop exception
(FNHE) is only created if the kernel can match the UDP packet to an
existing socket.
This behavior allows off-path attackers to conduct a side-channel attack
on the FNHE cache in order to discover the ephemeral port used by a
connected UDP socket.
Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache
less predictible") tried to mitigate such attacks by making it harder
for attackers to discover hash collisions in the FNHE cache and by
randomizing the number of exceptions a hash bucket can hold,
respectively. Unfortunately, both of the mitigations can be bypassed.
Instead, mitigate such attacks by always creating a FNHE, even before
trying to find a matching socket. Do that by calling ipv4_update_pmtu()
and ipv4_redirect(), the helpers used when the quoted packet did not
originate from a socket.
This means that guesses (right or wrong) from an off-path attacker will
always result in a FNHE being created or updated in the cache that the
attacker can observe.
Pass an oif of 0, in a similar fashion to icmp_err(). This is also the
oif used by the socket path for sockets that are not bound to a device.
Note that this does not allow attackers to create FNHEs that they could
not create before, as both helpers can already be reached with little to
no validation. For example, by sending an ICMP error that quotes an ICMP
Echo Reply or one that quotes a UDP source port that matches a wildcard
socket.
Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ipv4_sk_update_pmtu() /
ipv4_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the FNHE cache of the nexthop resolved by the no socket helpers and
another in the FNHE cache of the nexthop used by the socket.
Severity
7.4 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4895c771c7f006b4b90f9d6b1d2210939ba57b38 , < ecd7ead4bf05e221e90f18a29aec570a50fd1592
(git)
Affected: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 , < be4fd05398f2b5e42029be70ee875fc749b8ce3a (git) Affected: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 , < 4c3499f79f8c7e8561266bcc220a18538cec0458 (git) |
|
| Linux | Linux |
Affected:
3.6
Unaffected: 0 , < 3.6 (semver) Unaffected: 6.18.59 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecd7ead4bf05e221e90f18a29aec570a50fd1592",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "be4fd05398f2b5e42029be70ee875fc749b8ce3a",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "4c3499f79f8c7e8561266bcc220a18538cec0458",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless predictible\") tried to mitigate such attacks by making it harder\nfor attackers to discover hash collisions in the FNHE cache and by\nrandomizing the number of exceptions a hash bucket can hold,\nrespectively. Unfortunately, both of the mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating a FNHE, even before\ntrying to find a matching socket. Do that by calling ipv4_update_pmtu()\nand ipv4_redirect(), the helpers used when the quoted packet did not\noriginate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in a FNHE being created or updated in the cache that the\nattacker can observe.\n\nPass an oif of 0, in a similar fashion to icmp_err(). This is also the\noif used by the socket path for sockets that are not bound to a device.\n\nNote that this does not allow attackers to create FNHEs that they could\nnot create before, as both helpers can already be reached with little to\nno validation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ipv4_sk_update_pmtu() /\nipv4_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the FNHE cache of the nexthop resolved by the no socket helpers and\nanother in the FNHE cache of the nexthop used by the socket."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote IPv4 ICMP Fragmentation Needed or Redirect message carries the attacker-controlled inner IPv4/UDP quote through ip_rcv(), icmp_rcv(), icmp_socket_deliver(), and udp_err(), where its guessed four-tuple is matched.\nAC:H - Exploiting a connected socket requires turning fnhe_hashfun() bucket occupancy and update_or_create_fnhe() eviction into an oracle while the UDP tuple remains live; keyed hashing, randomized bucket depth, cache noise, and the short DNS response window are conditions the attacker cannot fully determine, although the mitigations can be bypassed.\nPR:N - icmp_rcv() checks packet structure, checksum, and policy but has no authentication or capability gate; icmp_unreach() passes a valid Fragmentation Needed quote to udp_err() without verifying that its sender is an on-path router.\nUI:N - The attacker can induce a resolver\u0027s connected UDP socket with a DNS query and then send the ICMP probes and cache-verification traffic; no victim user action is required.\nS:U - The FNHE oracle in udp_err() compromises networking and application data governed by the same host security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The __udp4_lib_lookup() result controls whether ipv4_sk_update_pmtu() or ipv4_sk_redirect() leaves an observable FNHE, disclosing the complete ephemeral source port. On a recursive DNS resolver, removing that entropy enables cache poisoning and redirection of client traffic, permitting broad disclosure.\nI:H - After learning the port, the same attacker can forge UDP DNS replies and brute-force the remaining transaction ID; an accepted reply can poison the resolver cache and map chosen names to attacker-controlled addresses.\nA:N - The fixed defect is the match-dependent FNHE oracle, not memory corruption or a crash. update_or_create_fnhe() already accepts other minimally validated ICMP cases, and the fix deliberately preserves exception creation, so route-cache manipulation is not an availability impact removed by this patch."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:13:01.358Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecd7ead4bf05e221e90f18a29aec570a50fd1592"
},
{
"url": "https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a"
},
{
"url": "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458"
}
],
"title": "ipv4: udp: Create exceptions before socket matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99077",
"datePublished": "2026-10-23T12:23:22.773Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-26T15:13:01.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99076 (GCVE-0-2026-99076)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv6: udp: Create exceptions before socket matching
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: udp: Create exceptions before socket matching
Currently, when ICMPv6 Packet Too Big and Redirect Message packets are
locally delivered and quote a UDP packet, an exception is only created
in the IPv6 exception cache if the kernel can match the UDP packet to an
existing socket.
This behavior allows off-path attackers to conduct a side-channel attack
on the exception cache in order to discover the ephemeral port used by a
connected UDP socket.
Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and
commit a00df2caffed ("ipv6: make exception cache less predictible") tried
to mitigate such attacks by making it harder for attackers to discover
hash collisions in the exception cache and by randomizing the number of
exceptions a hash bucket can hold, respectively. Unfortunately, both of
the mitigations can be bypassed.
Instead, mitigate such attacks by always creating an exception, even
before trying to find a matching socket. Do that by calling
ip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted
packet did not originate from a socket.
This means that guesses (right or wrong) from an off-path attacker will
always result in an exception being created or updated in the cache that
the attacker can observe.
Pass the ifindex of the ingress device and the default uid, in a similar
fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any
nexthop in ip6_redirect_nh_match() and no exception would be created in
response to a Redirect Message.
Note that this does not allow attackers to create exceptions that they
could not create before, as both helpers can already be reached with
little to no validation. For example, by sending an ICMPv6 error that
quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that
matches a wildcard socket.
Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ip6_sk_update_pmtu() /
ip6_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the exception cache of the nexthop resolved by the no socket helpers
and another in the exception cache of the nexthop used by the socket.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < 8c9b310c958be33ba8fb9d0e6b77811d013e10c0
(git)
Affected: 2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < ac76cab50e899a7346408b8d3c3a4192c2eefb9f (git) |
|
| Linux | Linux |
Affected:
4.15
Unaffected: 0 , < 4.15 (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c9b310c958be33ba8fb9d0e6b77811d013e10c0",
"status": "affected",
"version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
"versionType": "git"
},
{
"lessThan": "ac76cab50e899a7346408b8d3c3a4192c2eefb9f",
"status": "affected",
"version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less predictible\") tried\nto mitigate such attacks by making it harder for attackers to discover\nhash collisions in the exception cache and by randomizing the number of\nexceptions a hash bucket can hold, respectively. Unfortunately, both of\nthe mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating an exception, even\nbefore trying to find a matching socket. Do that by calling\nip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted\npacket did not originate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in an exception being created or updated in the cache that\nthe attacker can observe.\n\nPass the ifindex of the ingress device and the default uid, in a similar\nfashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any\nnexthop in ip6_redirect_nh_match() and no exception would be created in\nresponse to a Redirect Message.\n\nNote that this does not allow attackers to create exceptions that they\ncould not create before, as both helpers can already be reached with\nlittle to no validation. For example, by sending an ICMPv6 error that\nquotes an ICMPv6 Echo Reply or one that quotes a UDP source port that\nmatches a wildcard socket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ip6_sk_update_pmtu() /\nip6_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the exception cache of the nexthop resolved by the no socket helpers\nand another in the exception cache of the nexthop used by the socket."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:19.727Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0"
},
{
"url": "https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"
}
],
"title": "ipv6: udp: Create exceptions before socket matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99076",
"datePublished": "2026-10-23T12:23:19.727Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:19.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99075 (GCVE-0-2026-99075)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
rust_binder: reschedule node refcount update on thread exit
Summary
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: reschedule node refcount update on thread exit
When a thread exits via BINDER_THREAD_EXIT, its pending work items are
cancelled. If a thread exits while holding a pending node refcount
increment (e.g. pushed as deferred work to that thread), the refcount
increment was previously dropped because Node::cancel() and
NodeWrapper::cancel() were no-ops.
Dropping the refcount update leaves the node's delivery state and count
state desynchronized, and userspace will not receive the notification,
which can cause the node to never be freed from the process's nodes tree
when all external references are dropped.
Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper
to move the pending refcount update to the process's work queue on thread
exit so another thread can deliver it to userspace.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 71cbad138969edecef01b28dff87d91b56db538d
(git)
Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1 (git) Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 2a74ccd1bcc170e66525f34e9de8652b57e2cf3d (git) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/android/binder/node.rs",
"drivers/android/binder/node/wrapper.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "71cbad138969edecef01b28dff87d91b56db538d",
"status": "affected",
"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
"versionType": "git"
},
{
"lessThan": "fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1",
"status": "affected",
"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
"versionType": "git"
},
{
"lessThan": "2a74ccd1bcc170e66525f34e9de8652b57e2cf3d",
"status": "affected",
"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/android/binder/node.rs",
"drivers/android/binder/node/wrapper.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: reschedule node refcount update on thread exit\n\nWhen a thread exits via BINDER_THREAD_EXIT, its pending work items are\ncancelled. If a thread exits while holding a pending node refcount\nincrement (e.g. pushed as deferred work to that thread), the refcount\nincrement was previously dropped because Node::cancel() and\nNodeWrapper::cancel() were no-ops.\n\nDropping the refcount update leaves the node\u0027s delivery state and count\nstate desynchronized, and userspace will not receive the notification,\nwhich can cause the node to never be freed from the process\u0027s nodes tree\nwhen all external references are dropped.\n\nFix this by implementing DeliverToRead::cancel() for Node and NodeWrapper\nto move the pending refcount update to the process\u0027s work queue on thread\nexit so another thread can deliver it to userspace."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:18.830Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/71cbad138969edecef01b28dff87d91b56db538d"
},
{
"url": "https://git.kernel.org/stable/c/fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1"
},
{
"url": "https://git.kernel.org/stable/c/2a74ccd1bcc170e66525f34e9de8652b57e2cf3d"
}
],
"title": "rust_binder: reschedule node refcount update on thread exit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99075",
"datePublished": "2026-10-23T12:23:18.830Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:18.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99074 (GCVE-0-2026-99074)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: stop PMTU walk when nexthop group shrinks
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop PMTU walk when nexthop group shrinks
Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if
multipath enabled") made __ip_rt_update_pmtu() update every path.
For nexthop objects, fib_info_num_path() and fib_info_nhc()
independently load nh->nh_grp. RCU protects each group's lifetime but
does not make the loads observe the same group. If replacement shrinks
the group after the loop accepts an index, fib_info_nhc() returns NULL
and update_or_create_fnhe() dereferences it.
A deterministic probe only widened the existing window between the real
operations. On v7.2, an RTM_NEWNEXTHOP replacement published a
one-member group after the PMTU reader accepted index 1 from a two-member
group, producing:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: update_or_create_fnhe+0x45/0x15b0
Stop when the indexed path is absent. Groups are dense, so no later
index exists in that snapshot. The same real-writer window completed
114,423 PMTU iterations without an oops with this check. A reproducer
is available on request.
Replacement requires CAP_NET_ADMIN in the network namespace. Where
unprivileged user namespaces are permitted, a local user can obtain it
in a new user and network namespace.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3bed2abab4a682d426624ce9add9d7b6d475d4e4 , < 7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a
(git)
Affected: 7f5005457b3072fe1ddf15bfef869f2a1d98e05e , < c60d17d6dd61adc761ac6f65a008fefbc54cbf87 (git) Affected: 7d3f3b4367f315a61fc615e3138f3d320da8c466 , < c6d670ac656badfd0e15355e07a13a6bdf3b69fd (git) Affected: 7d3f3b4367f315a61fc615e3138f3d320da8c466 , < f27483f9975b5065ff67054cc7eb8edac6083488 (git) Affected: 7d3f3b4367f315a61fc615e3138f3d320da8c466 , < 6619e01855e65ef35723685a557e3eb106f4ecf5 (git) Affected: fc07a232326a623d0be482e307c08ea7049c2846 (git) Affected: b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e (git) Affected: 6.6.79 , < 6.6.160 (semver) Affected: 6.12.16 , < 6.12.113 (semver) Affected: 5.15.179 , < 5.16 (semver) Affected: 6.1.129 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a",
"status": "affected",
"version": "3bed2abab4a682d426624ce9add9d7b6d475d4e4",
"versionType": "git"
},
{
"lessThan": "c60d17d6dd61adc761ac6f65a008fefbc54cbf87",
"status": "affected",
"version": "7f5005457b3072fe1ddf15bfef869f2a1d98e05e",
"versionType": "git"
},
{
"lessThan": "c6d670ac656badfd0e15355e07a13a6bdf3b69fd",
"status": "affected",
"version": "7d3f3b4367f315a61fc615e3138f3d320da8c466",
"versionType": "git"
},
{
"lessThan": "f27483f9975b5065ff67054cc7eb8edac6083488",
"status": "affected",
"version": "7d3f3b4367f315a61fc615e3138f3d320da8c466",
"versionType": "git"
},
{
"lessThan": "6619e01855e65ef35723685a557e3eb106f4ecf5",
"status": "affected",
"version": "7d3f3b4367f315a61fc615e3138f3d320da8c466",
"versionType": "git"
},
{
"status": "affected",
"version": "fc07a232326a623d0be482e307c08ea7049c2846",
"versionType": "git"
},
{
"status": "affected",
"version": "b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.79",
"versionType": "semver"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "6.12.16",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.179",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.129",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.129",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh-\u003enh_grp. RCU protects each group\u0027s lifetime but\ndoes not make the loads observe the same group. If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\noperations. On v7.2, an RTM_NEWNEXTHOP replacement published a\none-member group after the PMTU reader accepted index 1 from a two-member\ngroup, producing:\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: update_or_create_fnhe+0x45/0x15b0\n\nStop when the indexed path is absent. Groups are dense, so no later\nindex exists in that snapshot. The same real-writer window completed\n114,423 PMTU iterations without an oops with this check. A reproducer\nis available on request.\n\nReplacement requires CAP_NET_ADMIN in the network namespace. Where\nunprivileged user namespaces are permitted, a local user can obtain it\nin a new user and network namespace."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:17.866Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a"
},
{
"url": "https://git.kernel.org/stable/c/c60d17d6dd61adc761ac6f65a008fefbc54cbf87"
},
{
"url": "https://git.kernel.org/stable/c/c6d670ac656badfd0e15355e07a13a6bdf3b69fd"
},
{
"url": "https://git.kernel.org/stable/c/f27483f9975b5065ff67054cc7eb8edac6083488"
},
{
"url": "https://git.kernel.org/stable/c/6619e01855e65ef35723685a557e3eb106f4ecf5"
}
],
"title": "ipv4: stop PMTU walk when nexthop group shrinks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99074",
"datePublished": "2026-10-23T12:23:17.866Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:17.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99073 (GCVE-0-2026-99073)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: stop exception dump when nexthop group shrinks
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop exception dump when nexthop group shrinks
Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU
protection") allowed IPv4 FIB dumps to run concurrently with nexthop
replacement.
fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,
then fib_info_nhc() independently reloads nh->nh_grp. If
RTM_NEWNEXTHOP replaces a group with fewer paths between those loads,
fib_info_nhc() returns NULL and the dump dereferences it through
nhc_flags.
Stop the walk when the indexed path is absent. Nexthop groups are
dense, so the current snapshot has no later path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4ce5dc9316de50e0da84beafe55d1344f829cece , < f91e472821e32f58b03eb631e20a67157e2b928b
(git)
Affected: 4ce5dc9316de50e0da84beafe55d1344f829cece , < 21cba134c30c17ae55f468b5809336437df5d7e6 (git) Affected: 4ce5dc9316de50e0da84beafe55d1344f829cece , < b9a30bb7b831e8c5a47fadbdf1760918aaf009cc (git) Affected: 4ce5dc9316de50e0da84beafe55d1344f829cece , < 4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f91e472821e32f58b03eb631e20a67157e2b928b",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
},
{
"lessThan": "21cba134c30c17ae55f468b5809336437df5d7e6",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
},
{
"lessThan": "b9a30bb7b831e8c5a47fadbdf1760918aaf009cc",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
},
{
"lessThan": "4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop exception dump when nexthop group shrinks\n\nCommit 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU\nprotection\") allowed IPv4 FIB dumps to run concurrently with nexthop\nreplacement.\n\nfib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and the dump dereferences it through\nnhc_flags.\n\nStop the walk when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:16.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f91e472821e32f58b03eb631e20a67157e2b928b"
},
{
"url": "https://git.kernel.org/stable/c/21cba134c30c17ae55f468b5809336437df5d7e6"
},
{
"url": "https://git.kernel.org/stable/c/b9a30bb7b831e8c5a47fadbdf1760918aaf009cc"
},
{
"url": "https://git.kernel.org/stable/c/4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2"
}
],
"title": "ipv4: stop exception dump when nexthop group shrinks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99073",
"datePublished": "2026-10-23T12:23:16.935Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:16.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99072 (GCVE-0-2026-99072)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: stop route notification sizing when nexthop group shrinks
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop route notification sizing when nexthop group shrinks
Commit 680aea08e78c ("net: ipv4: Emit notification when fib
hardware flags are changed") added an RCU-only fib_nlmsg_size() call
for asynchronous hardware flag notifications.
fib_nlmsg_size() checks fib_info_num_path() before each iteration,
then fib_info_nhc() independently reloads nh->nh_grp. If
RTM_NEWNEXTHOP replaces a group with fewer paths between those loads,
fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences
it.
Stop sizing when the indexed path is absent. Nexthop groups are
dense, so the current snapshot has no later path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
680aea08e78c003292415518ad270bc20f9c80b1 , < 72d9d17092bb37b0717f12042a0817d01a1f9e78
(git)
Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < d3daa33c7af92e38f2274bbd2576f58bfbaf89e6 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72d9d17092bb37b0717f12042a0817d01a1f9e78",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "d3daa33c7af92e38f2274bbd2576f58bfbaf89e6",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:15.735Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72d9d17092bb37b0717f12042a0817d01a1f9e78"
},
{
"url": "https://git.kernel.org/stable/c/ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54"
},
{
"url": "https://git.kernel.org/stable/c/c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49"
},
{
"url": "https://git.kernel.org/stable/c/ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88"
},
{
"url": "https://git.kernel.org/stable/c/d3daa33c7af92e38f2274bbd2576f58bfbaf89e6"
}
],
"title": "ipv4: stop route notification sizing when nexthop group shrinks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99072",
"datePublished": "2026-10-23T12:23:15.735Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:15.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99071 (GCVE-0-2026-99071)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: do not warn on route notification size race
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: do not warn on route notification size race
Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware
flags are changed") added asynchronous route notifications for hardware
flag changes.
fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later
fills it with fib_dump_info() while holding only RCU. With nexthop
compatibility mode enabled, a concurrent replacement can grow the group
between these independent snapshots. fib_dump_info() can then
legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and
reports the error to listeners.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
680aea08e78c003292415518ad270bc20f9c80b1 , < 088ba80eef85fa7a5ad8f9e7c82b403c99242b56
(git)
Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < 78a1cf5c54b2f795c81fedb530755a8d01cc84f0 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < 7dfa7ca97f3ac46353edd4cc44f7733758e4535b (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < 221ef5e1e44a044790f0f54e6aa237883f475a4d (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < e02a5b6588161673ef75a4bc5cdfb62bd493374d (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "088ba80eef85fa7a5ad8f9e7c82b403c99242b56",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "78a1cf5c54b2f795c81fedb530755a8d01cc84f0",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "7dfa7ca97f3ac46353edd4cc44f7733758e4535b",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "221ef5e1e44a044790f0f54e6aa237883f475a4d",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "e02a5b6588161673ef75a4bc5cdfb62bd493374d",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:14.297Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56"
},
{
"url": "https://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0"
},
{
"url": "https://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b"
},
{
"url": "https://git.kernel.org/stable/c/221ef5e1e44a044790f0f54e6aa237883f475a4d"
},
{
"url": "https://git.kernel.org/stable/c/e02a5b6588161673ef75a4bc5cdfb62bd493374d"
}
],
"title": "ipv4: do not warn on route notification size race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99071",
"datePublished": "2026-10-23T12:23:14.297Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:14.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99070 (GCVE-0-2026-99070)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv6: do not warn on route notification size race
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: do not warn on route notification size race
fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later
fills it with rt6_fill_node(). With nexthop compatibility mode enabled,
a concurrent replacement can grow the group between these independent
snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so
the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and
reports the error to listeners.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
907eea486888cfe118c19759bbc4b8fca2e004df , < 8a3b935b6b6037eefb36bd27a60793a008358e8d
(git)
Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < 7b112bd43f1172fb152e848570a957467008a5ae (git) Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < 4ac7d92a4698e34e614c254359665b9de1f65283 (git) Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5a (git) Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < c97426ec649d99596d8969e1a052c16b14b7b485 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a3b935b6b6037eefb36bd27a60793a008358e8d",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "7b112bd43f1172fb152e848570a957467008a5ae",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "4ac7d92a4698e34e614c254359665b9de1f65283",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "291fe0bafee78c95f9f2e7f579f17793fd5a1e5a",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "c97426ec649d99596d8969e1a052c16b14b7b485",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node(). With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:13.342Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d"
},
{
"url": "https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae"
},
{
"url": "https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283"
},
{
"url": "https://git.kernel.org/stable/c/291fe0bafee78c95f9f2e7f579f17793fd5a1e5a"
},
{
"url": "https://git.kernel.org/stable/c/c97426ec649d99596d8969e1a052c16b14b7b485"
}
],
"title": "ipv6: do not warn on route notification size race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99070",
"datePublished": "2026-10-23T12:23:13.342Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:13.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}