Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
29954 vulnerabilities found for linux by linux
CVE-2026-74579 (GCVE-0-2026-74579)
Vulnerability from nvd – Published: 2026-08-17 05:28 – Updated: 2026-08-17 05:28
VLAI
EPSS
VEX
Title
netfilter: nft_payload: fix mask build for partial field offload
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload
expression that covers only part of a header field. For a partial IPv6
address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which
is undefined on the 32-bit int operand. It also trims only one word, so
the remaining words stay 0xffffffff (and when priv_len is a multiple of 4
the trim is skipped entirely), leaving the mask covering more bytes than
the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20
shift exponent 120 is too large for 32-bit type 'int'
...
The match is byte-granular and struct nft_data is zero-initialised, so the
correct mask is simply the first priv_len bytes set to 0xff. Set those
bytes directly and drop the word/shift trimming; this removes the undefined
shift and no longer over-masks the trailing bytes.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < b19b5d2e042c294e2cc1c908dc598f9d64015396
(git)
Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < a375d8ace807767f29f276b681b6324c74929b1d (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 16b553c46e347bc9de9946c4960654d5884a86de (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 630295d5bba1d0e0f494cc459452eb0a0058c545 (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 39e88f28fb32bf02bd4b525c24c842c9cff5663d (git) Affected: 5c2b4b4f9fa5b765b927e361e3d310bcb5773015 (git) Affected: 5.9.14 , < 5.10 (semver) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b19b5d2e042c294e2cc1c908dc598f9d64015396",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "a375d8ace807767f29f276b681b6324c74929b1d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "16b553c46e347bc9de9946c4960654d5884a86de",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "630295d5bba1d0e0f494cc459452eb0a0058c545",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "39e88f28fb32bf02bd4b525c24c842c9cff5663d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"status": "affected",
"version": "5c2b4b4f9fa5b765b927e361e3d310bcb5773015",
"versionType": "git"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: fix mask build for partial field offload\n\nnft_payload_offload_mask() builds the offload match mask for a payload\nexpression that covers only part of a header field. For a partial IPv6\naddress match (field_len = 16, priv_len = 1) that shift is 1 \u003c\u003c 120, which\nis undefined on the 32-bit int operand. It also trims only one word, so\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4\nthe trim is skipped entirely), leaving the mask covering more bytes than\nthe rule matches.\n\n UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20\n shift exponent 120 is too large for 32-bit type \u0027int\u0027\n ...\n\nThe match is byte-granular and struct nft_data is zero-initialised, so the\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those\nbytes directly and drop the word/shift trimming; this removes the undefined\nshift and no longer over-masks the trailing bytes."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:28:27.768Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396"
},
{
"url": "https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d"
},
{
"url": "https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de"
},
{
"url": "https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545"
},
{
"url": "https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d"
}
],
"title": "netfilter: nft_payload: fix mask build for partial field offload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74579",
"datePublished": "2026-08-17T05:28:27.768Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:28:27.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74578 (GCVE-0-2026-74578)
Vulnerability from nvd – Published: 2026-08-16 08:20 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
crypto: algif_skcipher - force synchronous processing on trees without ctx->state
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_skcipher - force synchronous processing on trees without ctx->state
The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv
directly into the skcipher request. After io_submit() the socket lock is
dropped and the request is processed asynchronously, so a concurrent
sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request
run under an attacker-controlled IV. For CTR/stream modes this is
IV/keystream reuse and lets an unprivileged user recover the plaintext of
a concurrent operation.
Snapshotting ctx->iv into per-request storage for the async path is not
sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -
the MSG_MORE inter-chunk IV chaining is carried solely by the in-place
req->iv writeback, which a snapshot redirects into per-request memory that
af_alg_free_resources() releases on completion, silently producing wrong
output. Writing the IV back from the completion callback instead is not
possible either: that would require lock_sock() there, but the callback can
run in softirq/atomic context, so it must not sleep.
Make the operation synchronous instead, which removes both the IV race and
any writeback race. This is equivalent to the upstream resolution, commit
fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the
AIO socket path across net/ entirely and so produces the same end state for
this file. This patch deviates from that commit deliberately: rather than
removing AIO socket support tree-wide, which would be far too invasive for
stable, it removes only the AIO branch in crypto/algif_skcipher.c.
io_submit() now completes synchronously; AF_ALG async is rarely used in
practice.
The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,
and is left alone to keep the fix minimal.
Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000
after the change; MSG_MORE chunked CTR output bit-identical to single-shot.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < bf09b0be8e851f050e98da702d247c14d81b591a
(git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 73dd3bf704ca6c20639de70c08e9a10bee904a95 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < f1a87ca0843d74482402a206ea2dfb315ee9acbd (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 60eafc7b08c6689ea3ad39eff8d97aefc8a087c7 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < d7860b682da55433b5da0591b0e4c1982ecd2689 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < b05defc41b27c7d0c05c45f67bf5b91c28f93669 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < fcc77d33a34cf271702e8daafb6c593e4626776d (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/algif_skcipher.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf09b0be8e851f050e98da702d247c14d81b591a",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "73dd3bf704ca6c20639de70c08e9a10bee904a95",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "f1a87ca0843d74482402a206ea2dfb315ee9acbd",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "60eafc7b08c6689ea3ad39eff8d97aefc8a087c7",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "d7860b682da55433b5da0591b0e4c1982ecd2689",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "b05defc41b27c7d0c05c45f67bf5b91c28f93669",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "fcc77d33a34cf271702e8daafb6c593e4626776d",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/algif_skcipher.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate\n\nThe AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-\u003eiv\ndirectly into the skcipher request. After io_submit() the socket lock is\ndropped and the request is processed asynchronously, so a concurrent\nsendmsg(ALG_SET_IV) can overwrite ctx-\u003eiv and make the in-flight request\nrun under an attacker-controlled IV. For CTR/stream modes this is\nIV/keystream reuse and lets an unprivileged user recover the plaintext of\na concurrent operation.\n\nSnapshotting ctx-\u003eiv into per-request storage for the async path is not\nsufficient. For ciphers with statesize == 0 - which includes cbc and ctr -\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place\nreq-\u003eiv writeback, which a snapshot redirects into per-request memory that\naf_alg_free_resources() releases on completion, silently producing wrong\noutput. Writing the IV back from the completion callback instead is not\npossible either: that would require lock_sock() there, but the callback can\nrun in softirq/atomic context, so it must not sleep.\n\nMake the operation synchronous instead, which removes both the IV race and\nany writeback race. This is equivalent to the upstream resolution, commit\nfcc77d33a34c (\"net: Remove support for AIO on sockets\"), which removed the\nAIO socket path across net/ entirely and so produces the same end state for\nthis file. This patch deviates from that commit deliberately: rather than\nremoving AIO socket support tree-wide, which would be far too invasive for\nstable, it removes only the AIO branch in crypto/algif_skcipher.c.\nio_submit() now completes synchronously; AF_ALG async is rarely used in\npractice.\n\nThe -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,\nand is left alone to keep the fix minimal.\n\nTested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls on an AF_ALG skcipher socket (socket/bind/accept/sendmsg plus async recvmsg, io_submit, aio_read, or io_uring read); the bug is not reachable from remote network protocols.\nAC:L - The attacker fully controls the race by running concurrent threads or syscalls on the same socket, timing async recvmsg/io_submit against sendmsg(ALG_SET_IV); pre-fix testing achieved thousands of successful IV injections in 200000 attempts.\nPR:L - Any unprivileged local user can create and use AF_ALG skcipher sockets without CAP_NET_ADMIN or init-namespace root; only standard UNIX discretionary access to the target socket FD is required, which includes same-UID multi-threaded processes.\nUI:N - Exploitation is fully attacker-driven through direct syscalls and requires no victim interaction such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to cryptographic operations on the compromised AF_ALG socket within the attacker\u0027s security context; it does not cross VM, container, or kernel-user authority boundaries like KVM escape or IOMMU bypass.\nC:H - Concurrent IV injection on CTR/stream ciphers causes keystream reuse, letting an attacker recover the full plaintext of an in-flight decrypt/encrypt on the same keyed socket even when the key never leaves kernel memory.\nI:H - Attacker-controlled IV injection corrupts in-flight cipher output and breaks MSG_MORE CBC/CTR chaining (statesize==0), silently producing attacker-influenced ciphertext/plaintext and undermining cryptographic integrity of concurrent operations.\nA:N - The flaw causes information disclosure and silent cryptographic corruption but does not kernel panic, oops, hang, or reliably deny service; availability impact is none beyond possible application-level misbehavior."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:57.219Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf09b0be8e851f050e98da702d247c14d81b591a"
},
{
"url": "https://git.kernel.org/stable/c/73dd3bf704ca6c20639de70c08e9a10bee904a95"
},
{
"url": "https://git.kernel.org/stable/c/f1a87ca0843d74482402a206ea2dfb315ee9acbd"
},
{
"url": "https://git.kernel.org/stable/c/7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd"
},
{
"url": "https://git.kernel.org/stable/c/60eafc7b08c6689ea3ad39eff8d97aefc8a087c7"
},
{
"url": "https://git.kernel.org/stable/c/d7860b682da55433b5da0591b0e4c1982ecd2689"
},
{
"url": "https://git.kernel.org/stable/c/b05defc41b27c7d0c05c45f67bf5b91c28f93669"
},
{
"url": "https://git.kernel.org/stable/c/fcc77d33a34cf271702e8daafb6c593e4626776d"
}
],
"title": "crypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74578",
"datePublished": "2026-08-16T08:20:32.055Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:57.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74577 (GCVE-0-2026-74577)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:22
VLAI
EPSS
VEX
Title
net: mpls: initialize rtm_tos in mpls_getroute()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mpls: initialize rtm_tos in mpls_getroute()
mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE
request by filling a struct rtmsg allocated from an skb whose data
area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every
field of the header except rtm_tos:
r = nlmsg_data(nlh);
r->rtm_family = AF_MPLS;
r->rtm_dst_len = 20;
r->rtm_src_len = 0;
r->rtm_table = RT_TABLE_MAIN;
r->rtm_type = RTN_UNICAST;
r->rtm_scope = RT_SCOPE_UNIVERSE;
r->rtm_protocol = rt->rt_protocol;
r->rtm_flags = 0;
struct rtmsg has no padding, so the one uninitialised byte rtm_tos
(offset 3) is copied straight to user space on recvmsg(), leaking a
byte of uninitialised heap memory. This is in contrast to
mpls_dump_route(), which fills the very same header and does set
rtm_tos = 0.
Initialize rtm_tos to 0, matching mpls_dump_route().
Reproduced with KMSAN by adding an MPLS route and issuing a
non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0
_copy_to_iter+0x36c/0x33f0
__skb_datagram_iter+0x196/0x12c0
skb_copy_datagram_iter+0x5b/0x210
netlink_recvmsg+0x37b/0xef0
...
Uninit was created at:
__alloc_skb+0x8ca/0x10e0
mpls_getroute+0x1280/0x3a40
rtnetlink_rcv_msg+0x1138/0x15a0
...
Byte 19 of 64 is uninitialized
(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 95651461cf77cc6590fa08c87667717e5dcfa55d
(git)
Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 1fea5ff0eb4aa7e951bb3d380248566c473aa377 (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < a5cdd2407dd890f741f59b8367e4c6c101cce154 (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 2dc2fffc704a4365cae1aae078ba62223aaeff93 (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 295dd295e2137e10e9a5b1891d97e0f08de76f03 (git) |
|
| Linux | Linux |
Affected:
4.13
Unaffected: 0 , < 4.13 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mpls/af_mpls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "95651461cf77cc6590fa08c87667717e5dcfa55d",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "1fea5ff0eb4aa7e951bb3d380248566c473aa377",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "a5cdd2407dd890f741f59b8367e4c6c101cce154",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "2dc2fffc704a4365cae1aae078ba62223aaeff93",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "295dd295e2137e10e9a5b1891d97e0f08de76f03",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mpls/af_mpls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: initialize rtm_tos in mpls_getroute()\n\nmpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE\nrequest by filling a struct rtmsg allocated from an skb whose data\narea is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every\nfield of the header except rtm_tos:\n\n\tr = nlmsg_data(nlh);\n\tr-\u003ertm_family\t = AF_MPLS;\n\tr-\u003ertm_dst_len\t= 20;\n\tr-\u003ertm_src_len\t= 0;\n\tr-\u003ertm_table\t= RT_TABLE_MAIN;\n\tr-\u003ertm_type\t= RTN_UNICAST;\n\tr-\u003ertm_scope\t= RT_SCOPE_UNIVERSE;\n\tr-\u003ertm_protocol = rt-\u003ert_protocol;\n\tr-\u003ertm_flags\t= 0;\n\nstruct rtmsg has no padding, so the one uninitialised byte rtm_tos\n(offset 3) is copied straight to user space on recvmsg(), leaking a\nbyte of uninitialised heap memory. This is in contrast to\nmpls_dump_route(), which fills the very same header and does set\nrtm_tos = 0.\n\nInitialize rtm_tos to 0, matching mpls_dump_route().\n\nReproduced with KMSAN by adding an MPLS route and issuing a\nnon-RTM_F_FIB_MATCH RTM_GETROUTE for its label:\n\n BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0\n _copy_to_iter+0x36c/0x33f0\n __skb_datagram_iter+0x196/0x12c0\n skb_copy_datagram_iter+0x5b/0x210\n netlink_recvmsg+0x37b/0xef0\n ...\n Uninit was created at:\n __alloc_skb+0x8ca/0x10e0\n mpls_getroute+0x1280/0x3a40\n rtnetlink_rcv_msg+0x1138/0x15a0\n ...\n Byte 19 of 64 is uninitialized\n\n(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:22:07.878Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/95651461cf77cc6590fa08c87667717e5dcfa55d"
},
{
"url": "https://git.kernel.org/stable/c/1fea5ff0eb4aa7e951bb3d380248566c473aa377"
},
{
"url": "https://git.kernel.org/stable/c/a5cdd2407dd890f741f59b8367e4c6c101cce154"
},
{
"url": "https://git.kernel.org/stable/c/2dc2fffc704a4365cae1aae078ba62223aaeff93"
},
{
"url": "https://git.kernel.org/stable/c/295dd295e2137e10e9a5b1891d97e0f08de76f03"
}
],
"title": "net: mpls: initialize rtm_tos in mpls_getroute()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74577",
"datePublished": "2026-08-15T12:28:14.408Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:22:07.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74576 (GCVE-0-2026-74576)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
mm/slab: prevent unbounded recursion in free path with new kmalloc type
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/slab: prevent unbounded recursion in free path with new kmalloc type
Commit 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from
its own slab") avoided recursive allocation of obj_exts from kmalloc
caches of the same size, by bumping the obj_exts array's allocation
size whenever the array size equals the size of the object being
allocated.
However, as reported by Danielle Costantino and Shakeel Butt,
even slabs from kmalloc caches of different sizes can form a cycle
by allocating obj_exts arrays from each other [1]:
What happened: a KMALLOC_NORMAL slab's obj_exts array (used by
allocation profiling / memcg accounting) is itself kmalloc()'d from a
KMALLOC_NORMAL cache, so the "slab holds another slab's obj_exts array"
relation can form cycles. With sizeof(struct slabobj_ext) == 16 and
the host's geometry:
- kmalloc-512 has 64 objects/slab -> array is 64*16 == 1024 bytes,
served from kmalloc-1k;
- kmalloc-1k has 32 objects/slab -> array is 32*16 == 512 bytes,
served from kmalloc-512.
A kmalloc-512 slab and a kmalloc-1k slab therefore hold each other's
obj_exts array. Discarding one frees the other's array, which empties
and discards that slab, which frees the first's array, and so on:
__free_slab() -> free_slab_obj_exts() -> kfree() -> discard_slab() ->
__free_slab() recurses along the cycle until the stack is exhausted.
With memory allocation profiling, this allows unbounded recursion
in the free path and led to a stack overflow on a production host in
the Meta fleet [1]:
BUG: TASK stack guard page was hit
Oops: stack guard page
RIP: 0010:kfree+0x8/0x5d0
Call Trace:
__free_slab+0x66/0xc0
kfree+0x3f0/0x5d0
... ( ~125x __free_slab <-> kfree ) ...
<kernel driver freeing a resource>
do_syscall_64
It is proposed [1] to resolve this issue by always serving the obj_exts
array allocation from kmalloc caches (or large kmalloc) of sizes larger
than the object size. However, as pointed out by Vlastimil Babka [2],
this can waste an excessive amount of memory as slabs from large
kmalloc sizes (e.g. kmalloc-8k) generally need obj_exts arrays much
smaller than the object size.
Therefore, rather than bumping the size, let us take a different
approach; disallow formation of cycles between kmalloc types when
allocating obj_exts arrays. Currently, all obj_exts arrays are served
from normal kmalloc caches. Cycles cannot be created if obj_exts arrays
of normal kmalloc caches are served from a special kmalloc type that can
never have obj_exts arrays.
To achieve this, create a new kmalloc type called KMALLOC_NO_OBJ_EXT.
KMALLOC_NO_OBJ_EXT caches are created with SLAB_NO_OBJ_EXT flag when
either 1) memory allocation profiling is not permanently disabled,
or 2) kmalloc types with a priority higher than KMALLOC_CGROUP are
aliased with KMALLOC_NORMAL.
Sheaf bootstrapping for KMALLOC_NO_OBJ_EXT caches now must be deferred
because allocation of a barn can trigger obj_exts array allocation of
normal kmalloc caches when the KMALLOC_NO_OBJ_EXT cache for that size
is not ready yet. For simplicity, perform bootstrapping of sheaves for
all kmalloc caches later.
Introduce a new slab alloc flag, SLAB_ALLOC_NO_OBJ_EXT, to prevent
allocation of obj_exts arrays, and let kmalloc_slab() override the type
to KMALLOC_NO_OBJ_EXT when specified. Note that kmalloc_type() remains
unchanged because kmalloc_flags() bypasses the kmalloc fastpath.
Do not pass SLAB_ALLOC_NO_RECURSE to kmalloc_flags() in
alloc_slab_obj_exts() and instead use SLAB_ALLOC_NO_OBJ_EXT only when
the objects are allocated from normal kmalloc caches. While this
prevents unbounded recursive allocation of obj_exts, it allows
KMALLOC_NO_OBJ_EXT caches to have sheaves.
Since sheaf allocations specify SLAB_ALLOC_NO_RECURSE that prevents
allocation of both sheaves and obj_exts arrays, the recursion depth
is bounded.
obj_exts arrays for non-
---truncated---
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4b8736964640fe160724e7135dc62883bddcdace , < 3e71bfbdd3fd81ee9fefd867fdb2be62bade4140
(git)
Affected: 4b8736964640fe160724e7135dc62883bddcdace , < d01e88d421a6d07f35235600a43fbd0e551cf292 (git) Affected: 4b8736964640fe160724e7135dc62883bddcdace , < ebefca49e4c69df24ba9307bfe0806230301d5c6 (git) Affected: 4b8736964640fe160724e7135dc62883bddcdace , < d9e6a7623938968e3752b67e37eaff097e559a54 (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/slab.h",
"mm/slab.h",
"mm/slab_common.c",
"mm/slub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e71bfbdd3fd81ee9fefd867fdb2be62bade4140",
"status": "affected",
"version": "4b8736964640fe160724e7135dc62883bddcdace",
"versionType": "git"
},
{
"lessThan": "d01e88d421a6d07f35235600a43fbd0e551cf292",
"status": "affected",
"version": "4b8736964640fe160724e7135dc62883bddcdace",
"versionType": "git"
},
{
"lessThan": "ebefca49e4c69df24ba9307bfe0806230301d5c6",
"status": "affected",
"version": "4b8736964640fe160724e7135dc62883bddcdace",
"versionType": "git"
},
{
"lessThan": "d9e6a7623938968e3752b67e37eaff097e559a54",
"status": "affected",
"version": "4b8736964640fe160724e7135dc62883bddcdace",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/slab.h",
"mm/slab.h",
"mm/slab_common.c",
"mm/slub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: prevent unbounded recursion in free path with new kmalloc type\n\nCommit 280ea9c3154b (\"mm/slab: avoid allocating slabobj_ext array from\nits own slab\") avoided recursive allocation of obj_exts from kmalloc\ncaches of the same size, by bumping the obj_exts array\u0027s allocation\nsize whenever the array size equals the size of the object being\nallocated.\n\nHowever, as reported by Danielle Costantino and Shakeel Butt,\neven slabs from kmalloc caches of different sizes can form a cycle\nby allocating obj_exts arrays from each other [1]:\n\n What happened: a KMALLOC_NORMAL slab\u0027s obj_exts array (used by\n allocation profiling / memcg accounting) is itself kmalloc()\u0027d from a\n KMALLOC_NORMAL cache, so the \"slab holds another slab\u0027s obj_exts array\"\n relation can form cycles. With sizeof(struct slabobj_ext) == 16 and\n the host\u0027s geometry:\n\n - kmalloc-512 has 64 objects/slab -\u003e array is 64*16 == 1024 bytes,\n served from kmalloc-1k;\n - kmalloc-1k has 32 objects/slab -\u003e array is 32*16 == 512 bytes,\n served from kmalloc-512.\n\n A kmalloc-512 slab and a kmalloc-1k slab therefore hold each other\u0027s\n obj_exts array. Discarding one frees the other\u0027s array, which empties\n and discards that slab, which frees the first\u0027s array, and so on:\n __free_slab() -\u003e free_slab_obj_exts() -\u003e kfree() -\u003e discard_slab() -\u003e\n __free_slab() recurses along the cycle until the stack is exhausted.\n\nWith memory allocation profiling, this allows unbounded recursion\nin the free path and led to a stack overflow on a production host in\nthe Meta fleet [1]:\n\n BUG: TASK stack guard page was hit\n Oops: stack guard page\n RIP: 0010:kfree+0x8/0x5d0\n Call Trace:\n __free_slab+0x66/0xc0\n kfree+0x3f0/0x5d0\n ... ( ~125x __free_slab \u003c-\u003e kfree ) ...\n \u003ckernel driver freeing a resource\u003e\n do_syscall_64\n\nIt is proposed [1] to resolve this issue by always serving the obj_exts\narray allocation from kmalloc caches (or large kmalloc) of sizes larger\nthan the object size. However, as pointed out by Vlastimil Babka [2],\nthis can waste an excessive amount of memory as slabs from large\nkmalloc sizes (e.g. kmalloc-8k) generally need obj_exts arrays much\nsmaller than the object size.\n\nTherefore, rather than bumping the size, let us take a different\napproach; disallow formation of cycles between kmalloc types when\nallocating obj_exts arrays. Currently, all obj_exts arrays are served\nfrom normal kmalloc caches. Cycles cannot be created if obj_exts arrays\nof normal kmalloc caches are served from a special kmalloc type that can\nnever have obj_exts arrays.\n\nTo achieve this, create a new kmalloc type called KMALLOC_NO_OBJ_EXT.\nKMALLOC_NO_OBJ_EXT caches are created with SLAB_NO_OBJ_EXT flag when\neither 1) memory allocation profiling is not permanently disabled,\nor 2) kmalloc types with a priority higher than KMALLOC_CGROUP are\naliased with KMALLOC_NORMAL.\n\nSheaf bootstrapping for KMALLOC_NO_OBJ_EXT caches now must be deferred\nbecause allocation of a barn can trigger obj_exts array allocation of\nnormal kmalloc caches when the KMALLOC_NO_OBJ_EXT cache for that size\nis not ready yet. For simplicity, perform bootstrapping of sheaves for\nall kmalloc caches later.\n\nIntroduce a new slab alloc flag, SLAB_ALLOC_NO_OBJ_EXT, to prevent\nallocation of obj_exts arrays, and let kmalloc_slab() override the type\nto KMALLOC_NO_OBJ_EXT when specified. Note that kmalloc_type() remains\nunchanged because kmalloc_flags() bypasses the kmalloc fastpath.\n\nDo not pass SLAB_ALLOC_NO_RECURSE to kmalloc_flags() in\nalloc_slab_obj_exts() and instead use SLAB_ALLOC_NO_OBJ_EXT only when\nthe objects are allocated from normal kmalloc caches. While this\nprevents unbounded recursive allocation of obj_exts, it allows\nKMALLOC_NO_OBJ_EXT caches to have sheaves.\n\nSince sheaf allocations specify SLAB_ALLOC_NO_RECURSE that prevents\nallocation of both sheaves and obj_exts arrays, the recursion depth\nis bounded.\n\nobj_exts arrays for non-\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the core SLUB kmalloc free path (__free_slab\u2192free_slab_obj_exts\u2192kfree\u2192discard_slab) shared by every kernel subsystem. On internet-facing servers with memory allocation profiling enabled (Meta production), remote workloads that drive routine frees of 512B/1kB kmalloc objects reach discard_slab and trigger the recursion.\nAC:L - With memory allocation profiling active, kmalloc-512 and kmalloc-1k slabs deterministically form a mutual obj_exts cycle from normal slab geometry. An attacker only needs to provoke standard kernel frees\u2014no races, special heap layout, or timing\u2014making exploitation reliable once profiling is enabled on the host.\nPR:N - Remote attackers need no account or kernel capabilities; unauthenticated network I/O that causes the kernel to free affected slabs suffices. Locally, any unprivileged process can reach kfree via ordinary syscalls, as in the documented Meta production crash through do_syscall_64.\nUI:N - Exploitation requires no victim interaction; the crash is triggered by attacker-driven or routine automated kernel memory free activity once the cyclic slabs exist.\nS:U - Impact is a kernel oops/stack guard fault within kernel context; it does not cross a VM, container, or IOMMU boundary into another security authority.\nC:N - The failure mode is unbounded recursion exhausting the kernel task stack (BUG: TASK stack guard page was hit). There is no memory corruption, use-after-free, or out-of-bounds read\u2014only repeated legitimate frees cycling until stack overflow.\nI:N - No integrity impact; objects are freed via the normal kfree path without arbitrary writes or control-flow hijacking. The recursion terminates at stack overflow without modifying attacker-controlled data.\nA:H - Exploitation reliably causes a kernel oops/panic via stack guard page violation (\"Oops: stack guard page\"), crashing the affected context and potentially the host, as demonstrated in Meta production with ~125 nested __free_slab/kfree frames."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:56.072Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e71bfbdd3fd81ee9fefd867fdb2be62bade4140"
},
{
"url": "https://git.kernel.org/stable/c/d01e88d421a6d07f35235600a43fbd0e551cf292"
},
{
"url": "https://git.kernel.org/stable/c/ebefca49e4c69df24ba9307bfe0806230301d5c6"
},
{
"url": "https://git.kernel.org/stable/c/d9e6a7623938968e3752b67e37eaff097e559a54"
}
],
"title": "mm/slab: prevent unbounded recursion in free path with new kmalloc type",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74576",
"datePublished": "2026-08-15T12:28:13.798Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:56.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74575 (GCVE-0-2026-74575)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
tb_xdp_handle_request() runs on system_wq and queues
xd->state_work via queue_delayed_work() in three request handlers:
PROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake),
and LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues
xd->properties_changed_work when local properties change.
Concurrently, tb_xdomain_remove() calls stop_handshake() which does
cancel_delayed_work_sync() on both delayed works. Later,
tb_xdomain_unregister() calls device_unregister() which eventually
frees the xdomain. Since commit 559c1e1e0134 ("thunderbolt: Run
tb_xdp_handle_request() in system workqueue") moved the request
handler off tb->wq, the handler and the remove path are no longer
serialized. If queue_delayed_work() executes after
cancel_delayed_work_sync() but before the xdomain is freed, the
delayed work fires on a freed object.
Add xd->removing that tb_xdomain_remove() sets under xd->lock
before calling stop_handshake(). Each external queue site holds
the same lock and checks removing before calling
queue_delayed_work(). This provides the mutual exclusion needed:
either the queue site acquires the lock first and queues work that
the subsequent cancel will see, or the remove path acquires the
lock first and the queue site observes removing == true and skips
the queue.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
559c1e1e013437bf190469efbcbd8bc803285853 , < 91b40862a02000f490b63f1d315be3ee31e83871
(git)
Affected: 559c1e1e013437bf190469efbcbd8bc803285853 , < 33c0ee18cf8665c974b00f4e0ba769fbc07efe10 (git) Affected: 559c1e1e013437bf190469efbcbd8bc803285853 , < 54a62153c765cd24239cde1f2633f2a2fd005368 (git) Affected: 559c1e1e013437bf190469efbcbd8bc803285853 , < 2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91 (git) Affected: 559c1e1e013437bf190469efbcbd8bc803285853 , < 2c5d2d3c3f70cde2565d7b279b544893a2035842 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c",
"include/linux/thunderbolt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91b40862a02000f490b63f1d315be3ee31e83871",
"status": "affected",
"version": "559c1e1e013437bf190469efbcbd8bc803285853",
"versionType": "git"
},
{
"lessThan": "33c0ee18cf8665c974b00f4e0ba769fbc07efe10",
"status": "affected",
"version": "559c1e1e013437bf190469efbcbd8bc803285853",
"versionType": "git"
},
{
"lessThan": "54a62153c765cd24239cde1f2633f2a2fd005368",
"status": "affected",
"version": "559c1e1e013437bf190469efbcbd8bc803285853",
"versionType": "git"
},
{
"lessThan": "2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91",
"status": "affected",
"version": "559c1e1e013437bf190469efbcbd8bc803285853",
"versionType": "git"
},
{
"lessThan": "2c5d2d3c3f70cde2565d7b279b544893a2035842",
"status": "affected",
"version": "559c1e1e013437bf190469efbcbd8bc803285853",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c",
"include/linux/thunderbolt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Prevent XDomain delayed work use-after-free on disconnect\n\ntb_xdp_handle_request() runs on system_wq and queues\nxd-\u003estate_work via queue_delayed_work() in three request handlers:\nPROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake),\nand LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues\nxd-\u003eproperties_changed_work when local properties change.\n\nConcurrently, tb_xdomain_remove() calls stop_handshake() which does\ncancel_delayed_work_sync() on both delayed works. Later,\ntb_xdomain_unregister() calls device_unregister() which eventually\nfrees the xdomain. Since commit 559c1e1e0134 (\"thunderbolt: Run\ntb_xdp_handle_request() in system workqueue\") moved the request\nhandler off tb-\u003ewq, the handler and the remove path are no longer\nserialized. If queue_delayed_work() executes after\ncancel_delayed_work_sync() but before the xdomain is freed, the\ndelayed work fires on a freed object.\n\nAdd xd-\u003eremoving that tb_xdomain_remove() sets under xd-\u003elock\nbefore calling stop_handshake(). Each external queue site holds\nthe same lock and checks removing before calling\nqueue_delayed_work(). This provides the mutual exclusion needed:\neither the queue site acquires the lock first and queues work that\nthe subsequent cancel will see, or the remove path acquires the\nlock first and the queue site observes removing == true and skips\nthe queue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - XDomain discovery packets reach the kernel over the Thunderbolt/USB4 control channel from a connected peer (adjacent host, dock, or inline device) on the shared physical link; no remote IP/network service is involved, but the attacker need not touch the victim chassis if they control the far end of an established TB connection.\nAC:L - The bug is a race between system_wq request handling and disconnect teardown; the peer attacker controls both sides by sending PROPERTIES_CHANGED, UUID, or LINK_STATE_CHANGE requests while forcing unplug/disconnect and can retry timing until delayed work is queued after cancel_delayed_work_sync().\nPR:N - No local account, capability, or root on the victim is required; any malicious or compromised Thunderbolt XDomain peer that can exchange discovery control-plane packets can trigger the vulnerable queue_delayed_work() paths without OS authentication.\nUI:N - During an active XDomain session the peer can send the triggering requests and force link teardown without any further victim action at exploit time; no additional mount, login, or sysfs operation is needed beyond the already-established Thunderbolt link.\nS:U - Impact is kernel heap use-after-free and memory corruption within kernel context; it does not directly cross VM, container, or IOMMU boundaries, though successful exploitation can yield standard local privilege escalation.\nC:H - Use-after-free on struct tb_xdomain lets attacker-influenced delayed work read freed kernel memory, enabling arbitrary kernel information disclosure and kernel pointer leaks that support further exploitation of the corruption primitive.\nI:H - Delayed work on the freed xdomain executes handshake state transitions, property/link updates, and hardware operations on attacker-reclaimed memory, enabling heap grooming and control-flow hijack for arbitrary kernel write/code execution.\nA:H - Accessing freed tb_xdomain via state_work or properties_changed_work causes kernel oops/panic or hang during disconnect, and a peer can repeat disconnect/request storms to deny Thunderbolt/XDomain services."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:54.971Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91b40862a02000f490b63f1d315be3ee31e83871"
},
{
"url": "https://git.kernel.org/stable/c/33c0ee18cf8665c974b00f4e0ba769fbc07efe10"
},
{
"url": "https://git.kernel.org/stable/c/54a62153c765cd24239cde1f2633f2a2fd005368"
},
{
"url": "https://git.kernel.org/stable/c/2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91"
},
{
"url": "https://git.kernel.org/stable/c/2c5d2d3c3f70cde2565d7b279b544893a2035842"
}
],
"title": "thunderbolt: Prevent XDomain delayed work use-after-free on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74575",
"datePublished": "2026-08-15T12:28:13.187Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:54.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74574 (GCVE-0-2026-74574)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
The failed_dev_add and failed_dev_name paths drop the file-device
reference while wq->wq_lock is still held. If put_device(fdev) drops the
last reference, idxd_file_dev_release() runs synchronously and tries to
take wq->wq_lock again, deadlocking.
Those paths also fall through into the later ctx cleanup labels even
though idxd_file_dev_release() owns that cleanup and frees ctx. This can
make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.
Move idxd_wq_get() before file-device setup can fail, since the release
callback always calls idxd_wq_put(). Then unlock wq->wq_lock before
put_device(fdev) and return directly from the file-device setup failure
path, leaving ctx cleanup to the release callback.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec , < 778ccbded2c8749c5be7f0dfa04fc9977a36fb7e
(git)
Affected: e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec , < 8d5d28285728be47c82fdf1c48be4268293c90e7 (git) Affected: e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec , < 0679c0c189d2548f00e1bac95be28e2df5c6c7f7 (git) Affected: e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec , < 6e26a41c4c1a706edaaa7c7dffc6b3b945707a55 (git) Affected: e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec , < ee1d7274102285d78a53161fc705a8d8cd40b066 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/cdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "778ccbded2c8749c5be7f0dfa04fc9977a36fb7e",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "8d5d28285728be47c82fdf1c48be4268293c90e7",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "0679c0c189d2548f00e1bac95be28e2df5c6c7f7",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "6e26a41c4c1a706edaaa7c7dffc6b3b945707a55",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "ee1d7274102285d78a53161fc705a8d8cd40b066",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/cdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()\n\nThe failed_dev_add and failed_dev_name paths drop the file-device\nreference while wq-\u003ewq_lock is still held. If put_device(fdev) drops the\nlast reference, idxd_file_dev_release() runs synchronously and tries to\ntake wq-\u003ewq_lock again, deadlocking.\n\nThose paths also fall through into the later ctx cleanup labels even\nthough idxd_file_dev_release() owns that cleanup and frees ctx. This can\nmake idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.\n\nMove idxd_wq_get() before file-device setup can fail, since the release\ncallback always calls idxd_wq_put(). Then unlock wq-\u003ewq_lock before\nput_device(fdev) and return directly from the file-device setup failure\npath, leaving ctx cleanup to the release callback."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through the local open() syscall on an Intel DSA/IDXD user workqueue character device (/dev/dsa/wq* or /dev/iax/wq*); idxd_cdev_open() is the cdev .open handler and is not reachable from any network-facing kernel service.\nAC:L - An attacker who can open the cdev can reliably hit the failed_dev_name/failed_dev_add cleanup by inducing GFP_KERNEL allocation failures (e.g., memory pressure) during device setup; no race or victim-controlled state beyond that is required.\nPR:L - Exploitation requires only local permission to open the configured user-type DSA workqueue cdev, which on DSA-equipped servers is commonly granted to unprivileged workload/service accounts via udev group ACLs after one-time admin WQ setup, not init-namespace root.\nUI:N - The attacker triggers the bug by opening the character device themselves; no additional end-user or administrator interaction is required at exploitation time beyond prior WQ enablement.\nS:U - The deadlock, use-after-free, and double-free corrupt kernel/IDXD driver heap state and block the affected workqueue; impact does not cross VM, IOMMU/DMA, or other security boundaries into a separate authority.\nC:H - On the error path put_device() synchronously runs idxd_file_dev_release(), which kfree()s ctx while idxd_cdev_open() still references it via filp-\u003eprivate_data, and the fall-through path can call idxd_xa_pasid_remove()/kfree() again\u2014classic kernel heap UAF enabling memory disclosure.\nI:H - Double-free and use-after-free of the kmalloc-backed idxd_user_context can corrupt slab metadata and be developed into arbitrary kernel memory writes and privilege escalation, not merely a controlled error return.\nA:H - Calling put_device() while holding wq-\u003ewq_lock deadlocks when idxd_file_dev_release() re-acquires that mutex, hanging the opener and blocking all other users of the workqueue; heap corruption can additionally panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:53.873Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/778ccbded2c8749c5be7f0dfa04fc9977a36fb7e"
},
{
"url": "https://git.kernel.org/stable/c/8d5d28285728be47c82fdf1c48be4268293c90e7"
},
{
"url": "https://git.kernel.org/stable/c/0679c0c189d2548f00e1bac95be28e2df5c6c7f7"
},
{
"url": "https://git.kernel.org/stable/c/6e26a41c4c1a706edaaa7c7dffc6b3b945707a55"
},
{
"url": "https://git.kernel.org/stable/c/ee1d7274102285d78a53161fc705a8d8cd40b066"
}
],
"title": "dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74574",
"datePublished": "2026-08-15T12:28:12.558Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:53.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74573 (GCVE-0-2026-74573)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID
taken from master->streams[0], assuming a device has exactly one stream. A
device with several streams gets only its first one mapped, so a guest vSID
invalidation cannot reach the others' ATC and IOTLB entries; a device with
none makes master->streams a ZERO_SIZE_PTR, read out of bounds.
Add an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP
when master->num_streams is not one, rather than mapping it silently.
Severity
9.3 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d68beb276ba26cec47350a6d468e967673ee0c56 , < 3808bab5d95ae79e333e11f6a73d178e084c645d
(git)
Affected: d68beb276ba26cec47350a6d468e967673ee0c56 , < 0acbc621341aca4eb94d9c2f43e1ab273ff088f0 (git) Affected: d68beb276ba26cec47350a6d468e967673ee0c56 , < c3b8ee84a965058b41275069d4696f37a8b14bf6 (git) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3808bab5d95ae79e333e11f6a73d178e084c645d",
"status": "affected",
"version": "d68beb276ba26cec47350a6d468e967673ee0c56",
"versionType": "git"
},
{
"lessThan": "0acbc621341aca4eb94d9c2f43e1ab273ff088f0",
"status": "affected",
"version": "d68beb276ba26cec47350a6d468e967673ee0c56",
"versionType": "git"
},
{
"lessThan": "c3b8ee84a965058b41275069d4696f37a8b14bf6",
"status": "affected",
"version": "d68beb276ba26cec47350a6d468e967673ee0c56",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE\n\narm_vsmmu_vsid_to_sid() maps a guest\u0027s vSID to a single physical Stream ID\ntaken from master-\u003estreams[0], assuming a device has exactly one stream. A\ndevice with several streams gets only its first one mapped, so a guest vSID\ninvalidation cannot reach the others\u0027 ATC and IOTLB entries; a device with\nnone makes master-\u003estreams a ZERO_SIZE_PTR, read out of bounds.\n\nAdd an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP\nwhen master-\u003enum_streams is not one, rather than mapping it silently."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires reaching arm_vsmmu_cache_invalidate() via the IOMMU_HWPT_INVALIDATE ioctl on /dev/iommu (or VFIO-compat fd), a local syscall path from a process or VMM forwarding guest nested-IOMMU invalidations to the host kernel.\nAC:L - Once a vDEVICE is registered on an ARM SMMUv3 vIOMMU with a multi-stream or zero-stream master, the attacker reliably issues ATC_INV/CFGI_CD invalidation commands; no race or uncontrollable memory layout is required beyond having such hardware attached.\nPR:N - A malicious guest or tenant VM with passed-through PCI and nested vIOMMU needs no host root or credentials; QEMU normally forwards guest IOMMU invalidations to host iommufd, reaching the vulnerable code without any host authentication or admin privilege.\nUI:N - Exploitation is fully attacker-driven through iommufd ioctls and does not require any victim user action such as opening files, clicking links, or mounting filesystems beyond the attacker-controlled device setup.\nS:C - Incomplete vSID-to-SID mapping leaves stale ATC/IOTLB entries on additional Stream IDs, allowing device DMA to bypass the guest nested IOMMU policy and reach host physical memory outside the guest security domain\u2014an IOMMU/DMA boundary violation.\nC:H - Stale translations on un-invalidated streams let a malicious guest or local user read host memory via DMA using cached mappings; the num_streams==0 path also performs an out-of-bounds read of master-\u003estreams[0].id from ZERO_SIZE_PTR, leaking kernel memory into the SID field.\nI:H - Stale IOTLB/ATC entries enable arbitrary DMA writes to previously mapped host pages, and the leaked/garbage SID from the out-of-bounds streams[0] read can target invalidation at unintended Stream IDs, corrupting IOMMU translation state.\nA:H - The zero-stream case dereferences master-\u003estreams[0] when streams is ZERO_SIZE_PTR, which can kernel-oops the host; even without a crash, stale TLB state enables sustained hostile DMA that can destabilize the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:52.745Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3808bab5d95ae79e333e11f6a73d178e084c645d"
},
{
"url": "https://git.kernel.org/stable/c/0acbc621341aca4eb94d9c2f43e1ab273ff088f0"
},
{
"url": "https://git.kernel.org/stable/c/c3b8ee84a965058b41275069d4696f37a8b14bf6"
}
],
"title": "iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74573",
"datePublished": "2026-08-15T12:28:11.935Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:52.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74572 (GCVE-0-2026-74572)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
btrfs: zoned: fix deadlock between metadata writeback and transaction commit
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: fix deadlock between metadata writeback and transaction commit
When writing out metadata extent buffers in a zoned filesystem,
btree_writepages() holds fs_info->zoned_meta_io_lock across the whole
writeback loop, including the call to btrfs_check_meta_write_pointer() ->
check_bg_is_active().
For the tree-log block group, check_bg_is_active() may fail to activate
the zone and fall back to btrfs_zone_finish_one_bg() to free an active
zone. That path waits for the running transaction to commit while still
holding zoned_meta_io_lock, but the committer needs that same lock to
write out the tree extents, so the two tasks deadlock:
Task A (kworker, metadata writeback) Task B (fsstress, transaction commit)
------------------------------------ -------------------------------------
wb_workfn() btrfs_commit_transaction(T)
btree_writepages() btrfs_write_and_wait_transaction()
btrfs_zoned_meta_io_lock() btrfs_write_marked_extents()
btrfs_check_meta_write_pointer() btree_writepages()
check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock()
btrfs_zone_finish_one_bg() <blocks on zoned_meta_io_lock,
btrfs_zone_finish() held by Task A>
do_zone_finish()
btrfs_inc_block_group_ro()
btrfs_wait_for_commit()
<blocks waiting for commit
of transaction T, done by
Task B>
The sibling branch in check_bg_is_active() already drops zoned_meta_io_lock
around do_zone_finish() for this exact reason. Do the same in the tree-log
branch: release the lock around btrfs_zone_finish_one_bg() and re-acquire
it afterwards. The lock only protects fs_info->active_{meta,system}_bg,
which this branch does not touch, and ctx->zoned_bg keeps a reference to
the block group across the unlock, so nothing is lost while the lock
is dropped.
This hang occasionally reproduces with fstests generic/475 on a zoned
btrfs filesystem.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
13bb483d32abb6f8ebd40141d87eb68f11cc2dd2 , < 18577e77c2c8adaadf1f7c6e9bcd1c0b14e5dcdd
(git)
Affected: 13bb483d32abb6f8ebd40141d87eb68f11cc2dd2 , < c3320873e0c04ce7b746fc8fe948f07bbbbdec33 (git) Affected: 13bb483d32abb6f8ebd40141d87eb68f11cc2dd2 , < deddd28fd83c264ee2ff5cd6b34449a9f1be6112 (git) Affected: 13bb483d32abb6f8ebd40141d87eb68f11cc2dd2 , < 75859a7cd77cd2ddaddbcb963e3fcd34738953af (git) Affected: 13bb483d32abb6f8ebd40141d87eb68f11cc2dd2 , < 1ebe51c29fa9755d5b2fea28727c051117907cf8 (git) Affected: fca3a1cd3ba47f1815e0c0fcdc9aafaf02ee0a75 (git) Affected: 6.5.5 , < 6.6 (semver) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/zoned.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18577e77c2c8adaadf1f7c6e9bcd1c0b14e5dcdd",
"status": "affected",
"version": "13bb483d32abb6f8ebd40141d87eb68f11cc2dd2",
"versionType": "git"
},
{
"lessThan": "c3320873e0c04ce7b746fc8fe948f07bbbbdec33",
"status": "affected",
"version": "13bb483d32abb6f8ebd40141d87eb68f11cc2dd2",
"versionType": "git"
},
{
"lessThan": "deddd28fd83c264ee2ff5cd6b34449a9f1be6112",
"status": "affected",
"version": "13bb483d32abb6f8ebd40141d87eb68f11cc2dd2",
"versionType": "git"
},
{
"lessThan": "75859a7cd77cd2ddaddbcb963e3fcd34738953af",
"status": "affected",
"version": "13bb483d32abb6f8ebd40141d87eb68f11cc2dd2",
"versionType": "git"
},
{
"lessThan": "1ebe51c29fa9755d5b2fea28727c051117907cf8",
"status": "affected",
"version": "13bb483d32abb6f8ebd40141d87eb68f11cc2dd2",
"versionType": "git"
},
{
"status": "affected",
"version": "fca3a1cd3ba47f1815e0c0fcdc9aafaf02ee0a75",
"versionType": "git"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/zoned.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: fix deadlock between metadata writeback and transaction commit\n\nWhen writing out metadata extent buffers in a zoned filesystem,\nbtree_writepages() holds fs_info-\u003ezoned_meta_io_lock across the whole\nwriteback loop, including the call to btrfs_check_meta_write_pointer() -\u003e\ncheck_bg_is_active().\n\nFor the tree-log block group, check_bg_is_active() may fail to activate\nthe zone and fall back to btrfs_zone_finish_one_bg() to free an active\nzone. That path waits for the running transaction to commit while still\nholding zoned_meta_io_lock, but the committer needs that same lock to\nwrite out the tree extents, so the two tasks deadlock:\n\n Task A (kworker, metadata writeback) Task B (fsstress, transaction commit)\n ------------------------------------ -------------------------------------\n wb_workfn() btrfs_commit_transaction(T)\n btree_writepages() btrfs_write_and_wait_transaction()\n btrfs_zoned_meta_io_lock() btrfs_write_marked_extents()\n btrfs_check_meta_write_pointer() btree_writepages()\n check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock()\n btrfs_zone_finish_one_bg() \u003cblocks on zoned_meta_io_lock,\n btrfs_zone_finish() held by Task A\u003e\n do_zone_finish()\n btrfs_inc_block_group_ro()\n btrfs_wait_for_commit()\n \u003cblocks waiting for commit\n of transaction T, done by\n Task B\u003e\n\nThe sibling branch in check_bg_is_active() already drops zoned_meta_io_lock\naround do_zone_finish() for this exact reason. Do the same in the tree-log\nbranch: release the lock around btrfs_zone_finish_one_bg() and re-acquire\nit afterwards. The lock only protects fs_info-\u003eactive_{meta,system}_bg,\nwhich this branch does not touch, and ctx-\u003ezoned_bg keeps a reference to\nthe block group across the unlock, so nothing is lost while the lock\nis dropped.\n\nThis hang occasionally reproduces with fstests generic/475 on a zoned\nbtrfs filesystem."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On storage servers exporting a zoned btrfs volume via nfsd or ksmbd, remote client write/fsync I/O reaches btrfs_commit_transaction() and btree_writepages() on the server kernel without any local syscall access.\nAC:L - The attacker controls both deadlock participants by driving concurrent metadata dirtying/writeback and transaction commits (reproduced with fsstress/fstests generic/475); the kworker writeback side is a direct result of attacker-generated btree dirty pages.\nPR:N - Exploitation requires only network write access to an NFS or SMB export of the zoned btrfs filesystem; no local account, capability, or init-namespace privilege is needed when the export permits client writes.\nUI:N - The deadlock is triggered entirely by the attacker\u0027s own concurrent write and sync I/O; no victim must mount a filesystem, open a file, or perform any interactive action.\nS:U - The mutex deadlock freezes btrfs metadata I/O within the same host kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:N - This is a lock-ordering deadlock with no memory corruption, out-of-bounds access, use-after-free, or information disclosure of any kind.\nI:N - The bug causes tasks to block indefinitely on locks but does not corrupt, modify, or overwrite any data or enable arbitrary writes or code execution.\nA:H - The circular wait between zoned_meta_io_lock and btrfs_wait_for_commit() permanently hangs metadata writeback and transaction commit, freezing all I/O on the affected zoned btrfs filesystem."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:51.651Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18577e77c2c8adaadf1f7c6e9bcd1c0b14e5dcdd"
},
{
"url": "https://git.kernel.org/stable/c/c3320873e0c04ce7b746fc8fe948f07bbbbdec33"
},
{
"url": "https://git.kernel.org/stable/c/deddd28fd83c264ee2ff5cd6b34449a9f1be6112"
},
{
"url": "https://git.kernel.org/stable/c/75859a7cd77cd2ddaddbcb963e3fcd34738953af"
},
{
"url": "https://git.kernel.org/stable/c/1ebe51c29fa9755d5b2fea28727c051117907cf8"
}
],
"title": "btrfs: zoned: fix deadlock between metadata writeback and transaction commit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74572",
"datePublished": "2026-08-15T12:28:11.328Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:51.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74571 (GCVE-0-2026-74571)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:22
VLAI
EPSS
VEX
Title
btrfs: skip global block reserve accounting for rescue mounts
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: skip global block reserve accounting for rescue mounts
[BUG]
Mounting with rescue=ibadroots after corrupting the block group tree
root triggers a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000100
RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]
Call Trace:
fill_dummy_bgs+0xd4/0x120 [btrfs]
open_ctree+0xc6e/0x1ca0 [btrfs]
btrfs_get_tree+0x50d/0xa40 [btrfs]
The same crash occurs with a corrupted raid stripe tree root, via
btrfs_read_block_groups() instead of fill_dummy_bgs().
[CAUSE]
With rescue=ibadroots, btrfs_read_roots() allows the mount to continue
when either root cannot be read, leaving the corresponding root pointer
NULL while its on-disk feature bit remains set.
btrfs_update_global_block_rsv() then dereferences the missing root based
on the feature bit alone.
[FIX]
Rescue mounts are fully read-only and cannot start transactions, so the
global reserve is never consumed. Under btrfs_is_full_ro(), mark the
reserve as full and return before performing the accounting.
And since we need to check if the fs is mount fully RO, export
fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.
[ Squash the fs_is_full_ro() export commit into this one. ]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8dbfc14fc736eb701089aff09645c3d4ad3decb1 , < 076349e4c8d11f6b58c4549976a513b2b4dc6df2
(git)
Affected: 8dbfc14fc736eb701089aff09645c3d4ad3decb1 , < 51a0e8399858621442807a26057bcd1cd3ced046 (git) Affected: cbec34d3021d47007a0334c634f7053dbaf93d02 (git) Affected: 1e8087589b5cf6fa17adaf57b64cf1656d77dfec (git) Affected: 6.1.43 , < 6.2 (semver) Affected: 6.4.8 , < 6.5 (semver) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/block-rsv.c",
"fs/btrfs/disk-io.c",
"fs/btrfs/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "076349e4c8d11f6b58c4549976a513b2b4dc6df2",
"status": "affected",
"version": "8dbfc14fc736eb701089aff09645c3d4ad3decb1",
"versionType": "git"
},
{
"lessThan": "51a0e8399858621442807a26057bcd1cd3ced046",
"status": "affected",
"version": "8dbfc14fc736eb701089aff09645c3d4ad3decb1",
"versionType": "git"
},
{
"status": "affected",
"version": "cbec34d3021d47007a0334c634f7053dbaf93d02",
"versionType": "git"
},
{
"status": "affected",
"version": "1e8087589b5cf6fa17adaf57b64cf1656d77dfec",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.43",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/block-rsv.c",
"fs/btrfs/disk-io.c",
"fs/btrfs/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: skip global block reserve accounting for rescue mounts\n\n[BUG]\nMounting with rescue=ibadroots after corrupting the block group tree\nroot triggers a NULL pointer dereference:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000100\n RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]\n Call Trace:\n fill_dummy_bgs+0xd4/0x120 [btrfs]\n open_ctree+0xc6e/0x1ca0 [btrfs]\n btrfs_get_tree+0x50d/0xa40 [btrfs]\n\nThe same crash occurs with a corrupted raid stripe tree root, via\nbtrfs_read_block_groups() instead of fill_dummy_bgs().\n\n[CAUSE]\nWith rescue=ibadroots, btrfs_read_roots() allows the mount to continue\nwhen either root cannot be read, leaving the corresponding root pointer\nNULL while its on-disk feature bit remains set.\n\nbtrfs_update_global_block_rsv() then dereferences the missing root based\non the feature bit alone.\n\n[FIX]\nRescue mounts are fully read-only and cannot start transactions, so the\nglobal reserve is never consumed. Under btrfs_is_full_ro(), mark the\nreserve as full and return before performing the accounting.\n\nAnd since we need to check if the fs is mount fully RO, export\nfs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.\n\n[ Squash the fs_is_full_ro() export commit into this one. ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:22:00.523Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/076349e4c8d11f6b58c4549976a513b2b4dc6df2"
},
{
"url": "https://git.kernel.org/stable/c/51a0e8399858621442807a26057bcd1cd3ced046"
}
],
"title": "btrfs: skip global block reserve accounting for rescue mounts",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74571",
"datePublished": "2026-08-15T12:28:10.711Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:22:00.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74570 (GCVE-0-2026-74570)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
ntfs: harden runlist realloc size calculations
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: harden runlist realloc size calculations
Add a shared helper to safely convert runlist element counts to byte sizes
using overflow checks, and use it in both ntfs_rl_realloc() and
ntfs_rl_realloc_nofail().
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
11ccc9107dc460de28af90fac1f42404d9802735 , < 57e7b8bf7b02a0140463fea786e5172cbdf2da2f
(git)
Affected: 11ccc9107dc460de28af90fac1f42404d9802735 , < 8bed376124ab4505b70083a2b91f2c7ef6d51e24 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/runlist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "57e7b8bf7b02a0140463fea786e5172cbdf2da2f",
"status": "affected",
"version": "11ccc9107dc460de28af90fac1f42404d9802735",
"versionType": "git"
},
{
"lessThan": "8bed376124ab4505b70083a2b91f2c7ef6d51e24",
"status": "affected",
"version": "11ccc9107dc460de28af90fac1f42404d9802735",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/runlist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: harden runlist realloc size calculations\n\nAdd a shared helper to safely convert runlist element counts to byte sizes\nusing overflow checks, and use it in both ntfs_rl_realloc() and\nntfs_rl_realloc_nofail()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Crafted NTFS metadata is parsed when remote clients read files on NFS- or SMB-exported NTFS mounts (ntfs_export_ops); nfsd/ksmbd VFS reads reach ntfs_mapping_pairs_decompress/ntfs_runlists_merge and the vulnerable ntfs_rl_realloc path without local shell access.\nAC:L - An attacker can deterministically craft NTFS mapping pairs or runlist merge sizes to force int overflow in realloc byte calculations; no races, rare configs, or victim-specific heap layout are required to trigger the undersized alloc and oversized memcpy.\nPR:N - Triggering the bug requires only access to mounted NTFS content (e.g., NFS/SMB read of an exported share or loop-mount in a user namespace with CAP_SYS_ADMIN), not real init-namespace root; no Linux superuser credentials are needed on the read/decompress code path.\nUI:N - Exploitation needs no victim interaction beyond the attacker or a remote client issuing normal filesystem reads/opens on crafted NTFS metadata; no mount dialog, USB insertion, or other user action by a separate victim is required.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross VM, container, or IOMMU boundaries to affect a separate authority.\nC:H - Integer-overflowed memcpy copies far beyond the undersized kvzalloc/kvmalloc buffer, corrupting adjacent kernel heap objects and enabling arbitrary kernel memory disclosure when leveraged for exploitation.\nI:H - The heap buffer overflow provides a strong arbitrary kernel write primitive via adjacent-object corruption and heap grooming, sufficient for control-flow hijacking and local privilege escalation.\nA:H - Corrupting kernel heap metadata reliably causes kernel oops/panic or forced reboot; even failed exploitation attempts typically crash the host, and successful exploitation can hang or kill the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:49.705Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/57e7b8bf7b02a0140463fea786e5172cbdf2da2f"
},
{
"url": "https://git.kernel.org/stable/c/8bed376124ab4505b70083a2b91f2c7ef6d51e24"
}
],
"title": "ntfs: harden runlist realloc size calculations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74570",
"datePublished": "2026-08-15T12:28:10.107Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:49.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74569 (GCVE-0-2026-74569)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
sip_help_tcp() stores the size change of each NAT-rewritten SIP message
in s16 diff and accumulates it in s16 tdiff, but a single message can
grow by more than S16_MAX while the packet stays under the 65535
enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long
Contact list expands the message by tens of kilobytes. diff then wraps,
and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,
so the next iteration's ct_sip_get_header() reads past the linearized skb
tail.
Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the
65535 byte packet limit, and the seqadj core is already s32
(nf_ct_seqadj_set() takes s32), so no previously accepted input is
rejected.
BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)
Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25
ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)
sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)
nf_confirm (net/netfilter/nf_conntrack_proto.c:183)
nf_hook_slow (net/netfilter/core.c:619)
ip6_output (net/ipv6/ip6_output.c:246)
ip6_forward (net/ipv6/ip6_output.c:690)
ipv6_rcv (net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6212)
process_backlog (net/core/dev.c:6676)
__napi_poll (net/core/dev.c:7735)
net_rx_action (net/core/dev.c:7955)
handle_softirqs (kernel/softirq.c:622)
run_ksoftirqd (kernel/softirq.c:1076)
...
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < 63eea41759fd682229c14e0a2205802b46d106f3
(git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < c97621a110e386b2dd69e276eb699e1d3cec581d (git) Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < f74554e67ccf04d1fa71069e8c9afa2717e40716 (git) Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64 (git) Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5 (git) |
|
| Linux | Linux |
Affected:
2.6.34
Unaffected: 0 , < 2.6.34 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netfilter/nf_conntrack_sip.h",
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "63eea41759fd682229c14e0a2205802b46d106f3",
"status": "affected",
"version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
"versionType": "git"
},
{
"lessThan": "c97621a110e386b2dd69e276eb699e1d3cec581d",
"status": "affected",
"version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
"versionType": "git"
},
{
"lessThan": "f74554e67ccf04d1fa71069e8c9afa2717e40716",
"status": "affected",
"version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
"versionType": "git"
},
{
"lessThan": "ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64",
"status": "affected",
"version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
"versionType": "git"
},
{
"lessThan": "db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5",
"status": "affected",
"version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netfilter/nf_conntrack_sip.h",
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()\n\nsip_help_tcp() stores the size change of each NAT-rewritten SIP message\nin s16 diff and accumulates it in s16 tdiff, but a single message can\ngrow by more than S16_MAX while the packet stays under the 65535\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long\nContact list expands the message by tens of kilobytes. diff then wraps,\nand \"datalen = datalen + diff - msglen\" yields a huge unsigned datalen,\nso the next iteration\u0027s ct_sip_get_header() reads past the linearized skb\ntail.\n\nWiden diff, tdiff and the seq_adjust hook to s32. Both are bounded by the\n65535 byte packet limit, and the seqadj core is already s32\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is\nrejected.\n\n BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25\n ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)\n nf_confirm (net/netfilter/nf_conntrack_proto.c:183)\n nf_hook_slow (net/netfilter/core.c:619)\n ip6_output (net/ipv6/ip6_output.c:246)\n ip6_forward (net/ipv6/ip6_output.c:690)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6212)\n process_backlog (net/core/dev.c:6676)\n __napi_poll (net/core/dev.c:7735)\n net_rx_action (net/core/dev.c:7955)\n handle_softirqs (kernel/softirq.c:622)\n run_ksoftirqd (kernel/softirq.c:1076)\n ..."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote attackers trigger sip_help_tcp() by sending crafted TCP SIP traffic that traverses netfilter nf_confirm() on POST_ROUTING/LOCAL_IN during packet receive/forward (ipv6_rcv\u2192ip6_forward\u2192ip6_output\u2192nf_hook_slow), the standard path for network-facing SIP ALG/NAT gateways.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, the attacker fully controls the TCP SIP payload (Contact list length and private URIs) to force \u003e32KB NAT expansion and deterministic s16 wrap; no race or external timing is required.\nPR:N - Exploitation requires no privileges on the victim kernel; a remote SIP peer only needs to deliver malicious TCP SIP packets through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the target system.\nUI:N - No victim user interaction is required beyond normal automated packet processing; the helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection tracking confirmation without any user action.\nS:U - Impact is confined to kernel netfilter/conntrack memory on the same security authority (e.g., a NAT firewall or router). This is not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - Integer overflow yields a huge unsigned datalen, causing ct_sip_get_header() to read past the linearized skb tail; KASAN reports a use-after-free read, and this out-of-bounds/UAF access can disclose adjacent kernel heap memory beyond the packet buffer.\nI:H - Although the immediate fault is a read past skb bounds, KASAN-classified UAF/out-of-bounds kernel heap corruption is exploitable with heap grooming for control of freed/reallocated objects, enabling arbitrary write and potential code execution in kernel context.\nA:H - The corrupted datalen drives out-of-bounds access in softirq packet processing (ksoftirqd), which can cause kernel oops/panic and denial of service on the NAT/firewall handling the SIP flow; the bug is reliably triggerable with crafted packets."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:48.559Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3"
},
{
"url": "https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d"
},
{
"url": "https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716"
},
{
"url": "https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64"
},
{
"url": "https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5"
}
],
"title": "netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74569",
"datePublished": "2026-08-15T12:28:09.476Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:48.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74568 (GCVE-0-2026-74568)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
KVM: arm64: vgic: Fix race between LPI release and re-registration
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Fix race between LPI release and re-registration
Fix a potential race between decrementing an LPI's reference count and
evicting that structure from the LPI xarray.
LPI structures are maintained in the VGIC LPI xarray (dist->lpi_xa).
When the reference count of an LPI structure drops to zero,
vgic_release_lpi_locked() removes the structure from the xarray and
frees it under the xarray lock.
However, the release of an LPI can race with a concurrent LPI
re-registration with the same INTID via vgic_add_lpi() on another CPU,
since the reference count drop and the xarray eviction are not performed
in a single atomic step. This can happen e.g. if the guest issues a
DISCARD while the LPI is still referenced from a vCPU's active-pending
list (ap_list), and the same INTID is re-mapped via MAPTI.
Particularly, vgic_release_lpi_locked() is called from two distinct
paths: direct release via vgic_put_irq(), and deferred release via
vgic_release_deleted_lpis(). During direct release, the issue can result
in deleting a newly registered LPI from the xarray:
CPU0 (Releasing LPI) CPU1 (Adding new LPI)
==================== =====================
vgic_put_irq()
__vgic_put_irq()
refcount_dec_and_test()
vgic_add_lpi()
xa_lock_irqsave()
old_irq = xa_load(.., intid)
vgic_try_get_irq_ref(old_irq) == false
new IRQ inserted --> __xa_store(.., intid, ..)
xa_unlock_irqrestore()
xa_lock_irqsave();
vgic_release_lpi_locked()
__xa_erase(.., irq->intid) <-- BUG: new IRQ is erased
kfree_rcu(old_irq)
During the deferred release path, the old IRQ can be leaked:
CPU0 (Releasing LPI) CPU1 (Adding new LPI)
==================== =====================
vgic_put_irq_norelease()
__vgic_put_irq()
refcount_dec_and_test()
irq->pending_release = true
vgic_add_lpi()
xa_lock_irqsave()
old_irq = xa_load(.., intid)
vgic_try_get_irq_ref(oldirq) == false
BUG: old IRQ overwritten --> __xa_store(.., intid, ..)
xa_unlock_irqrestore()
vgic_release_deleted_lpis()
xa_lock_irqsave()
xa_for_each() { .. } <-- old IRQ with pending_release = true
is gone, so it cannot be released
To fix the direct release path, move the reference count drop inside
the xarray lock, making sure that vgic_add_lpi() never encounters the
to-be-released LPI.
In the deferred release path, the refcount drop must happen under a raw
spinlock, so the xarray lock cannot be grabbed, and the same solution
does not work. Instead, update vgic_add_lpi(), so that if it evicts
an LPI from the xarray, it takes on the responsibility of freeing it.
Consequently, an LPI may now be freed concurrently after a deferred
release drops the refcount, so accessing the pending_release field is no
longer safe from use-after-free. Delete all uses of the flag, and update
vgic_release_deleted_lpis() to identify orphaned LPIs purely based on
their refcount.
Severity
9.3 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3a08a6ca7c373198c84e2a8c025c395ee966ff8a , < 292e80a159aa88635bf668a7212cfdf526b8bd52
(git)
Affected: 3a08a6ca7c373198c84e2a8c025c395ee966ff8a , < cbfe2b24a1ea9de35032dbdd100fdc700f5be92d (git) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-its.c",
"arch/arm64/kvm/vgic/vgic.c",
"include/kvm/arm_vgic.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "292e80a159aa88635bf668a7212cfdf526b8bd52",
"status": "affected",
"version": "3a08a6ca7c373198c84e2a8c025c395ee966ff8a",
"versionType": "git"
},
{
"lessThan": "cbfe2b24a1ea9de35032dbdd100fdc700f5be92d",
"status": "affected",
"version": "3a08a6ca7c373198c84e2a8c025c395ee966ff8a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-its.c",
"arch/arm64/kvm/vgic/vgic.c",
"include/kvm/arm_vgic.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Fix race between LPI release and re-registration\n\nFix a potential race between decrementing an LPI\u0027s reference count and\nevicting that structure from the LPI xarray.\n\nLPI structures are maintained in the VGIC LPI xarray (dist-\u003elpi_xa).\nWhen the reference count of an LPI structure drops to zero,\nvgic_release_lpi_locked() removes the structure from the xarray and\nfrees it under the xarray lock.\n\nHowever, the release of an LPI can race with a concurrent LPI\nre-registration with the same INTID via vgic_add_lpi() on another CPU,\nsince the reference count drop and the xarray eviction are not performed\nin a single atomic step. This can happen e.g. if the guest issues a\nDISCARD while the LPI is still referenced from a vCPU\u0027s active-pending\nlist (ap_list), and the same INTID is re-mapped via MAPTI.\n\nParticularly, vgic_release_lpi_locked() is called from two distinct\npaths: direct release via vgic_put_irq(), and deferred release via\nvgic_release_deleted_lpis(). During direct release, the issue can result\nin deleting a newly registered LPI from the xarray:\n\n CPU0 (Releasing LPI) CPU1 (Adding new LPI)\n ==================== =====================\n vgic_put_irq()\n __vgic_put_irq()\n refcount_dec_and_test()\n vgic_add_lpi()\n xa_lock_irqsave()\n old_irq = xa_load(.., intid)\n vgic_try_get_irq_ref(old_irq) == false\n new IRQ inserted --\u003e __xa_store(.., intid, ..)\n xa_unlock_irqrestore()\n xa_lock_irqsave();\n vgic_release_lpi_locked()\n __xa_erase(.., irq-\u003eintid) \u003c-- BUG: new IRQ is erased\n kfree_rcu(old_irq)\n\nDuring the deferred release path, the old IRQ can be leaked:\n\n CPU0 (Releasing LPI) CPU1 (Adding new LPI)\n ==================== =====================\n vgic_put_irq_norelease()\n __vgic_put_irq()\n refcount_dec_and_test()\n irq-\u003epending_release = true\n vgic_add_lpi()\n xa_lock_irqsave()\n old_irq = xa_load(.., intid)\n vgic_try_get_irq_ref(oldirq) == false\n BUG: old IRQ overwritten --\u003e __xa_store(.., intid, ..)\n xa_unlock_irqrestore()\n\n vgic_release_deleted_lpis()\n xa_lock_irqsave()\n xa_for_each() { .. } \u003c-- old IRQ with pending_release = true\n is gone, so it cannot be released\n\nTo fix the direct release path, move the reference count drop inside\nthe xarray lock, making sure that vgic_add_lpi() never encounters the\nto-be-released LPI.\n\nIn the deferred release path, the refcount drop must happen under a raw\nspinlock, so the xarray lock cannot be grabbed, and the same solution\ndoes not work. Instead, update vgic_add_lpi(), so that if it evicts\nan LPI from the xarray, it takes on the responsibility of freeing it.\nConsequently, an LPI may now be freed concurrently after a deferred\nrelease drops the refcount, so accessing the pending_release field is no\nlonger safe from use-after-free. Delete all uses of the flag, and update\nvgic_release_deleted_lpis() to identify orphaned LPIs purely based on\ntheir refcount."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached when a malicious KVM guest writes emulated GICv3 ITS MMIO (GITS_CWRITER), processing DISCARD/MAPTI commands that call vgic_add_lpi() and vgic_put_irq(); this requires guest code execution on the host, not remote network input.\nAC:L - The race is guest-driven and repeatable: a malicious guest can keep an LPI referenced on a vCPU ap_list, issue DISCARD, and concurrently re-map the same INTID via MAPTI across vCPUs, controlling both sides of the refcount/xarray race.\nPR:N - Exploitation requires only code inside a KVM guest on an arm64 host with VGICv3 ITS/LPI (common on cloud ARM servers); no host root, CAP_SYS_ADMIN, or other elevated host privileges are needed beyond normal VM tenancy.\nUI:N - No victim interaction is required; the attacker fully controls guest ITS command submission, interrupt injection, and multi-vCPU timing from within the VM.\nS:C - Corrupting host-kernel VGIC LPI objects (lpi_xa entries, vgic_irq structures) from guest MMIO crosses the KVM virtual-machine security boundary and can enable guest-to-host escape.\nC:H - The race can erase a newly registered LPI while freeing the old one, leaving stale host pointers (ite-\u003eirq, ap_list) to freed vgic_irq objects; this use-after-free enables arbitrary host kernel memory disclosure via heap reuse.\nI:H - Host heap corruption of vgic_irq structures and xarray state from the race provides use-after-free write primitives that can be leveraged for arbitrary host kernel modification and VM escape code execution.\nA:H - The bug can cause host kernel crashes (oops/panic) from freeing live LPIs, orphaned IRQ state, and use-after-free during concurrent VGIC interrupt handling on multiple vCPUs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:47.432Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/292e80a159aa88635bf668a7212cfdf526b8bd52"
},
{
"url": "https://git.kernel.org/stable/c/cbfe2b24a1ea9de35032dbdd100fdc700f5be92d"
}
],
"title": "KVM: arm64: vgic: Fix race between LPI release and re-registration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74568",
"datePublished": "2026-08-15T12:28:08.859Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:47.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74567 (GCVE-0-2026-74567)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
keys: fix out-of-bounds read in keyring_get_key_chunk()
Summary
In the Linux kernel, the following vulnerability has been resolved:
keys: fix out-of-bounds read in keyring_get_key_chunk()
For description-level chunks keyring_get_key_chunk() advances the read
pointer by level * sizeof(long) past the inline prefix but only
bounds-checks the prefix, so a long enough key description is read past
its kmemdup(desc, desc_len + 1) allocation. Compute the full byte
offset and bounds-check the description against it before reading.
The walk only reaches a description-level chunk when two keys collide
through the hash, x, type and domain_tag chunks, so this is reached from
an unprivileged add_key(2) with a crafted pair of same-type keys whose
index hashes collide; KASAN reports a slab-out-of-bounds read.
Severity
7.1 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f771fde82051976a6fc0fd570f8b86de4a92124b , < d1933e03e8c74a018550c31a393b79c4d95bff40
(git)
Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < 3a744838453fb9309ce5a5526d3252e211d60152 (git) Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < e9417d21a22ad2ec398e78fcf084b717ce92cf2f (git) Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < 8dba33c1e779d0fb9a2acb31e354cf0fc0229111 (git) Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < 63918731f9ae25b5deb022f118e941e6dddfcef4 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/keyring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1933e03e8c74a018550c31a393b79c4d95bff40",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "3a744838453fb9309ce5a5526d3252e211d60152",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "e9417d21a22ad2ec398e78fcf084b717ce92cf2f",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "8dba33c1e779d0fb9a2acb31e354cf0fc0229111",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "63918731f9ae25b5deb022f118e941e6dddfcef4",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/keyring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: fix out-of-bounds read in keyring_get_key_chunk()\n\nFor description-level chunks keyring_get_key_chunk() advances the read\npointer by level * sizeof(long) past the inline prefix but only\nbounds-checks the prefix, so a long enough key description is read past\nits kmemdup(desc, desc_len + 1) allocation. Compute the full byte\noffset and bounds-check the description against it before reading.\n\nThe walk only reaches a description-level chunk when two keys collide\nthrough the hash, x, type and domain_tag chunks, so this is reached from\nan unprivileged add_key(2) with a crafted pair of same-type keys whose\nindex hashes collide; KASAN reports a slab-out-of-bounds read."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through local key-management syscalls (add_key, keyctl link/search) that walk the keyring assoc_array in security/keys/keyring.c; the keys subsystem has no network-facing handler or remote packet path.\nAC:L - An attacker fully controls both key descriptions and can offline-compute a same-type pair whose index collides through hash, x, type and domain_tag yet differs later, deterministically forcing description-level chunks without races or uncontrollable layout.\nPR:L - The fix commit and add_key path confirm any unprivileged local user can add crafted keys to their own session/user keyring (lookup_user_key with KEY_NEED_WRITE); no real-root capability or init-namespace privilege is required.\nUI:N - Exploitation is self-contained: the attacker issues add_key twice with crafted colliding descriptions into a writable keyring they own; no action by another user or administrator is required.\nS:U - The out-of-bounds slab read and any disclosed data remain within the host kernel\u0027s security authority; this is standard local kernel memory access, not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - keyring_get_key_chunk() reads up to a word past the kmemdup(desc,desc_len+1) allocation when the offset includes level*sizeof(long), yielding an adjacent-heap read primitive that can disclose kernel pointers and other sensitive slab contents.\nI:N - This is a read-only out-of-bounds access with no kernel memory write, type confusion, or control-flow hijack; the bug discloses data but does not directly modify kernel or victim integrity.\nA:H - KASAN reports slab-out-of-bounds on trigger, and reading beyond the description allocation can fault at slab/page boundaries; the add_key insertion path is trivially repeatable for denial-of-service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:46.340Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40"
},
{
"url": "https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152"
},
{
"url": "https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f"
},
{
"url": "https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111"
},
{
"url": "https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4"
}
],
"title": "keys: fix out-of-bounds read in keyring_get_key_chunk()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74567",
"datePublished": "2026-08-15T12:28:08.240Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:46.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74566 (GCVE-0-2026-74566)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:21
VLAI
EPSS
VEX
Title
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
Summary
In the Linux kernel, the following vulnerability has been resolved:
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
keyring_get_key_chunk() loads description bytes into the index chunk low
address first, while keyring_diff_objects() numbers the first differing
bit from the low end and folds the absolute byte index into the level
without removing the inline-prefix offset the level already carries.
The two disagree on byte order and bit position, so the array can be
told two keys first differ at a bit that does not differ in the chunk
the walker uses, letting crafted descriptions collide into one node.
Load the chunk in the order keyring_diff_objects() assumes and drop the
inline-prefix length when folding the byte index into the level. This
only changes the in-memory ordering used to place keys within a keyring;
add, search and read of non-colliding keys are unaffected.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f771fde82051976a6fc0fd570f8b86de4a92124b , < bd0f976ef89dce6db458bf75bc2cf51127becc41
(git)
Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < 7269df3e7fcfa308e6a456305162f7788747bdbd (git) Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < 3d9f16c0b643ceac305526b2e2fe25c2c6166926 (git) Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < 7e5397a3fed0dee7779bd084bec3c0584db3c930 (git) Affected: f771fde82051976a6fc0fd570f8b86de4a92124b , < 58565eef0f8d861aae92abfb7658458d661cee17 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/keyring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd0f976ef89dce6db458bf75bc2cf51127becc41",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "7269df3e7fcfa308e6a456305162f7788747bdbd",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "3d9f16c0b643ceac305526b2e2fe25c2c6166926",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "7e5397a3fed0dee7779bd084bec3c0584db3c930",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
},
{
"lessThan": "58565eef0f8d861aae92abfb7658458d661cee17",
"status": "affected",
"version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/keyring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring key-chunk byte order agree with keyring_diff_objects()\n\nkeyring_get_key_chunk() loads description bytes into the index chunk low\naddress first, while keyring_diff_objects() numbers the first differing\nbit from the low end and folds the absolute byte index into the level\nwithout removing the inline-prefix offset the level already carries.\nThe two disagree on byte order and bit position, so the array can be\ntold two keys first differ at a bit that does not differ in the chunk\nthe walker uses, letting crafted descriptions collide into one node.\n\nLoad the chunk in the order keyring_diff_objects() assumes and drop the\ninline-prefix length when folding the byte index into the level. This\nonly changes the in-memory ordering used to place keys within a keyring;\nadd, search and read of non-colliding keys are unaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:21:54.673Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd0f976ef89dce6db458bf75bc2cf51127becc41"
},
{
"url": "https://git.kernel.org/stable/c/7269df3e7fcfa308e6a456305162f7788747bdbd"
},
{
"url": "https://git.kernel.org/stable/c/3d9f16c0b643ceac305526b2e2fe25c2c6166926"
},
{
"url": "https://git.kernel.org/stable/c/7e5397a3fed0dee7779bd084bec3c0584db3c930"
},
{
"url": "https://git.kernel.org/stable/c/58565eef0f8d861aae92abfb7658458d661cee17"
}
],
"title": "keys: make keyring key-chunk byte order agree with keyring_diff_objects()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74566",
"datePublished": "2026-08-15T12:28:07.628Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:21:54.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74565 (GCVE-0-2026-74565)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
netfilter: nf_tables: make nft_object rhltable per table
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: make nft_object rhltable per table
The nft_object rhltable is global, this allows for accessing objects
that are being dismangled from lookup path by other existing netns.
Given the nft_obj_destroy() releases the object inmediately, this might
lead to use-after-free of these objects that are being released.
Make the existing rhltable per table to address this issue to deal with
with the nft_rcv_nl_event() path too.
Update nft_obj_lookup() to take the table as non-const, otherwise,
compiler complains when passing the objname_ht to rhltable_lookup().
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4d44175aa5bb5f68772b1eb0306554812294ca52 , < 1948e4f85b855618b5b9a27265f98d816f4cb7cb
(git)
Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < 63ba12b664a2cd3220ed43e22c717715f4cc2ae8 (git) Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af (git) Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < f4f699790590bd0896c48a71e9232a65198f92f0 (git) |
|
| Linux | Linux |
Affected:
5.1
Unaffected: 0 , < 5.1 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1948e4f85b855618b5b9a27265f98d816f4cb7cb",
"status": "affected",
"version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
"versionType": "git"
},
{
"lessThan": "63ba12b664a2cd3220ed43e22c717715f4cc2ae8",
"status": "affected",
"version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
"versionType": "git"
},
{
"lessThan": "7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af",
"status": "affected",
"version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
"versionType": "git"
},
{
"lessThan": "f4f699790590bd0896c48a71e9232a65198f92f0",
"status": "affected",
"version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: make nft_object rhltable per table\n\nThe nft_object rhltable is global, this allows for accessing objects\nthat are being dismangled from lookup path by other existing netns.\nGiven the nft_obj_destroy() releases the object inmediately, this might\nlead to use-after-free of these objects that are being released.\nMake the existing rhltable per table to address this issue to deal with\nwith the nft_rcv_nl_event() path too.\n\nUpdate nft_obj_lookup() to take the table as non-const, otherwise,\ncompiler complains when passing the objname_ht to rhltable_lookup()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is triggered only through local NETLINK_NETFILTER nftables configuration syscalls (NFT_MSG_NEWOBJ/GETOBJ/DELOBJ and rule/objref setup) that call nft_obj_lookup(); per kernel CNA guidance, nf_tables/netlink is Local, not network-reachable packet processing.\nAC:L - The attacker controls both sides of the race by running concurrent Netlink sockets\u2014one closing to fire nft_rcv_nl_event()/__nft_release_table() object teardown and another issuing object lookups/commits\u2014and can retry until the global rhltable collision-chain walk hits freed memory.\nPR:L - All nf_tables Netlink handlers are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in nfnetlink_rcv(); CAP_NET_ADMIN is obtainable by an unprivileged user inside a user+network namespace (unshare -Urn), not requiring init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through their own nftables Netlink operations and socket close events without another user mounting, opening files, or taking any action.\nS:U - Impact is kernel heap use-after-free and potential local privilege escalation within the same kernel security authority; this is standard in-kernel memory corruption, not a distinct VM-guest-to-host or sandbox-boundary escape.\nC:H - nft_obj_lookup() holds rcu_read_lock and walks the global rhltable collision chain, dereferencing struct nft_object fields (key.table, ops, genmask) that nft_obj_destroy() may have already kfree\u0027d, giving arbitrary kernel memory read potential from UAF.\nI:H - Immediate kfree after rhltable_remove without waiting for RCU readers enables classic slab UAF heap corruption that can be groomed into arbitrary kernel writes, control-flow hijacking, and local privilege escalation beyond a bounded or transient fault.\nA:H - Concurrent destruction via nft_rcv_nl_event() and active nft_obj_lookup() reliably provokes KASAN-class slab use-after-free kernel oops/panic during rhlist traversal; UAF is inherently crash-prone even when not fully weaponized for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:45.246Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1948e4f85b855618b5b9a27265f98d816f4cb7cb"
},
{
"url": "https://git.kernel.org/stable/c/63ba12b664a2cd3220ed43e22c717715f4cc2ae8"
},
{
"url": "https://git.kernel.org/stable/c/7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af"
},
{
"url": "https://git.kernel.org/stable/c/f4f699790590bd0896c48a71e9232a65198f92f0"
}
],
"title": "netfilter: nf_tables: make nft_object rhltable per table",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74565",
"datePublished": "2026-08-15T12:28:07.015Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:45.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74564 (GCVE-0-2026-74564)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the
dsthash_ent structure which represents an entry in the hashtable. There
is a union area which uses a different layout to express the rate match
mode.
Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode
flag is requested by two or more different rules that refer to the same
hashtable. Otherwise, uninitialized access to the burst field in the
union is possible.
Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by
revision less than 3 too.
Severity
7.1 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bea74641e3786d51dcf1175527cc1781420961c9 , < 24683fea1f06bd3bd2707b99460e859bc6464c22
(git)
Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0 (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < d186f77d18bdfb252d401ff992ca3001a6a65a0f (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 06a76334243ccd875a981aa8bb46c0f931ef1e3b (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 305b63e1402267459fdabb183af4527f6799eebf (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_hashlimit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24683fea1f06bd3bd2707b99460e859bc6464c22",
"status": "affected",
"version": "bea74641e3786d51dcf1175527cc1781420961c9",
"versionType": "git"
},
{
"lessThan": "32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0",
"status": "affected",
"version": "bea74641e3786d51dcf1175527cc1781420961c9",
"versionType": "git"
},
{
"lessThan": "d186f77d18bdfb252d401ff992ca3001a6a65a0f",
"status": "affected",
"version": "bea74641e3786d51dcf1175527cc1781420961c9",
"versionType": "git"
},
{
"lessThan": "06a76334243ccd875a981aa8bb46c0f931ef1e3b",
"status": "affected",
"version": "bea74641e3786d51dcf1175527cc1781420961c9",
"versionType": "git"
},
{
"lessThan": "305b63e1402267459fdabb183af4527f6799eebf",
"status": "affected",
"version": "bea74641e3786d51dcf1175527cc1781420961c9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_hashlimit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH\n\nThe XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the\ndsthash_ent structure which represents an entry in the hashtable. There\nis a union area which uses a different layout to express the rate match\nmode.\n\nUpdate .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode\nflag is requested by two or more different rules that refer to the same\nhashtable. Otherwise, uninitialized access to the burst field in the\nunion is possible.\n\nReject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by\nrevision less than 3 too."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires installing conflicting xt_hashlimit iptables rules via the IPT_SO_SET_REPLACE netlink path (CAP_NET_ADMIN), which is local netfilter configuration per kernel CVSS guidance; the uninitialized burst read occurs later during packet matching in hashlimit_mt_common().\nAC:L - An attacker with CAP_NET_ADMIN can deterministically install two rules sharing one hashtable name\u2014one standard hashlimit and one with XT_HASHLIMIT_RATE_MATCH\u2014so the first packet evaluated by both rules triggers uninitialized burst access without races or external timing.\nPR:L - Installing iptables hashlimit rules requires CAP_NET_ADMIN, which unprivileged users can obtain in their own network namespace via user namespaces (unshare -Urn) on common Linux distributions, containers, and Kubernetes workloads with NET_ADMIN capability.\nUI:N - No victim interaction is required; once the conflicting hashlimit rules are installed, the attacker fully controls exploitation by sending network packets that traverse the affected iptables hooks (INPUT, FORWARD, PREROUTING).\nS:U - Impact is confined to kernel netfilter hashlimit state and packet-filtering decisions within the target network namespace; it does not cross a VM, container-to-host, or IOMMU security boundary.\nC:H - The rate-match path reads an uninitialized burst field from kmem_cache-allocated dsthash_ent entries whose standard-mode initialization only writes the first 24 bytes of the rateinfo union, exposing stale kernel slab heap contents.\nI:H - Cross-mode union aliasing causes rate-match logic to read uninitialized burst and write current_rate/prev_window over credit/credit_cap/cost fields, corrupting shared hashtable entries and enabling arbitrary firewall match verdict manipulation (type confusion).\nA:N - The vulnerability causes uninitialized memory reads and union field corruption affecting match results, but does not trigger kernel oops, panic, hang, or host-level denial of service; impact is incorrect packet classification rather than system crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:44.158Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22"
},
{
"url": "https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0"
},
{
"url": "https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f"
},
{
"url": "https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b"
},
{
"url": "https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf"
}
],
"title": "netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74564",
"datePublished": "2026-08-15T12:28:06.392Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:44.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74563 (GCVE-0-2026-74563)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
Summary
In the Linux kernel, the following vulnerability has been resolved:
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
rds_tcp_laddr_check() looks up a scoped IPv6 interface with
dev_get_by_index_rcu(), drops the RCU read-side lock, and only then
passes the bare struct net_device * into ipv6_chk_addr().
dev_get_by_index_rcu() only keeps the device alive within the same RCU
read-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can
free the net_device; ipv6_chk_addr() then dereferences the stale pointer
in __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading
freed memory.
Keep the RCU read-side lock held across the ipv6_chk_addr() call instead
of dropping it right after the lookup, so the device cannot be freed
while it is in use.
BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)
Read of size 8 at addr ffff8880106ec000 by task exploit/153
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
__ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)
ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972)
rds_tcp_laddr_check (net/rds/tcp.c:370)
rds_bind (net/rds/bind.c:248)
__sys_bind (net/socket.c:1920)
__x64_sys_bind (net/socket.c:1956)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < 76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef
(git)
Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < b1d480fce05f857dc438080cd8c9244b84a83494 (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < 8398bc477d3cb3e2b018a5aaac2bec0f69acda30 (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < 78f75d632f74b8de0f081a128588f7c37d0d1164 (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "b1d480fce05f857dc438080cd8c9244b84a83494",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "8398bc477d3cb3e2b018a5aaac2bec0f69acda30",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "78f75d632f74b8de0f081a128588f7c37d0d1164",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()\n\nrds_tcp_laddr_check() looks up a scoped IPv6 interface with\ndev_get_by_index_rcu(), drops the RCU read-side lock, and only then\npasses the bare struct net_device * into ipv6_chk_addr().\n\ndev_get_by_index_rcu() only keeps the device alive within the same RCU\nread-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can\nfree the net_device; ipv6_chk_addr() then dereferences the stale pointer\nin __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading\nfreed memory.\n\nKeep the RCU read-side lock held across the ipv6_chk_addr() call instead\nof dropping it right after the lookup, so the device cannot be freed\nwhile it is in use.\n\n BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n Read of size 8 at addr ffff8880106ec000 by task exploit/153\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972)\n rds_tcp_laddr_check (net/rds/tcp.c:370)\n rds_bind (net/rds/bind.c:248)\n __sys_bind (net/socket.c:1920)\n __x64_sys_bind (net/socket.c:1956)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The slab use-after-free is reached via the bind(2) syscall on an AF_RDS socket with a link-local IPv6 address and non-zero scope_id; the KASAN reproducer follows bind()-\u003erds_bind()-\u003erds_tcp_laddr_check(), requiring on-host access to race bind against RTM_DELLINK netlink deletion of the referenced netdev.\nAC:L - Exploitation requires racing rds_tcp_laddr_check() against RTM_DELLINK freeing the netdev; the attacker controls both sides by concurrently calling bind() and deleting the interface via netlink (e.g., a veth in a user namespace) and can retry until the race succeeds.\nPR:L - An unprivileged local user can create AF_RDS sockets and call bind(); the RTM_DELLINK race is achievable with CAP_NET_ADMIN obtainable inside an unprivileged user+network namespace (unshare -Urn), not requiring init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through bind/netlink syscalls without needing another user to mount a filesystem, click, or open a file.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the same kernel/host security boundary; this is not a VM-guest-to-host escape, sandbox escape, or cross-authority boundary crossing.\nC:H - The bug is a slab use-after-free read of a freed struct net_device in __ipv6_chk_addr_and_flags() via a stale pointer passed to ipv6_chk_addr(); UAF reads of kernel heap objects can disclose sensitive memory and enable further exploitation.\nI:H - Use-after-free on struct net_device heap memory provides memory corruption primitives that can be groomed for arbitrary kernel writes, control-flow hijacking, and local privilege escalation, not merely a bounded or transient error.\nA:H - The reported KASAN slab-use-after-free causes kernel oops/panic during the stale dereference in the IPv6 address-check path; UAF conditions are inherently crash-prone even when not fully weaponized for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:43.058Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef"
},
{
"url": "https://git.kernel.org/stable/c/f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff"
},
{
"url": "https://git.kernel.org/stable/c/b1d480fce05f857dc438080cd8c9244b84a83494"
},
{
"url": "https://git.kernel.org/stable/c/8398bc477d3cb3e2b018a5aaac2bec0f69acda30"
},
{
"url": "https://git.kernel.org/stable/c/78f75d632f74b8de0f081a128588f7c37d0d1164"
}
],
"title": "rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74563",
"datePublished": "2026-08-15T12:28:05.768Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:43.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74562 (GCVE-0-2026-74562)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
nexthop: take nh->lock for f6i_list walks in replace check and notify
Summary
In the Linux kernel, the following vulnerability has been resolved:
nexthop: take nh->lock for f6i_list walks in replace check and notify
fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list
during an RTNL-serialized nexthop replace without holding nh->lock. IPv6
RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under
nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a
concurrent route delete that unlinks and frees a fib6_info:
BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799)
Read of size 4 at addr ffff888014607e64 by task exploit/143
rt6_fill_node.isra.0 (net/ipv6/route.c:5799)
fib6_rt_update (net/ipv6/route.c:6412)
__nexthop_replace_notify (net/ipv4/nexthop.c:2542)
rtm_new_nexthop (net/ipv4/nexthop.c:2554)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605)
Read of size 8 at addr ffff888014a7d068 by task exploit/142
fib6_check_nh_list (net/ipv4/nexthop.c:1605)
rtm_new_nexthop (net/ipv4/nexthop.c:2575)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
Both walks only read the entries and take no tb6_lock, so protect them
with nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC
under the lock.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
081efd18326e353c6fbfdeff903a83edde953f72 , < bb2b072c619c1f741a6234257050f72005dc63ef
(git)
Affected: 081efd18326e353c6fbfdeff903a83edde953f72 , < 072cd1f21819dedd2252e704d255de3b0cfc61a7 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb2b072c619c1f741a6234257050f72005dc63ef",
"status": "affected",
"version": "081efd18326e353c6fbfdeff903a83edde953f72",
"versionType": "git"
},
{
"lessThan": "072cd1f21819dedd2252e704d255de3b0cfc61a7",
"status": "affected",
"version": "081efd18326e353c6fbfdeff903a83edde953f72",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: take nh-\u003elock for f6i_list walks in replace check and notify\n\nfib6_check_nh_list() and __nexthop_replace_notify() walk nh-\u003ef6i_list\nduring an RTNL-serialized nexthop replace without holding nh-\u003elock. IPv6\nRTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under\nnh-\u003elock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a\nconcurrent route delete that unlinks and frees a fib6_info:\n\n BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799)\n Read of size 4 at addr ffff888014607e64 by task exploit/143\n rt6_fill_node.isra.0 (net/ipv6/route.c:5799)\n fib6_rt_update (net/ipv6/route.c:6412)\n __nexthop_replace_notify (net/ipv4/nexthop.c:2542)\n rtm_new_nexthop (net/ipv4/nexthop.c:2554)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\n BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605)\n Read of size 8 at addr ffff888014a7d068 by task exploit/142\n fib6_check_nh_list (net/ipv4/nexthop.c:1605)\n rtm_new_nexthop (net/ipv4/nexthop.c:2575)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nBoth walks only read the entries and take no tb6_lock, so protect them\nwith nh-\u003elock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC\nunder the lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local RTNETLINK messages (RTM_NEWNEXTHOP replace and concurrent RTM_NEWROUTE/RTM_DELROUTE) sent on AF_NETLINK sockets, not by processing remote network packets.\nAC:L - An attacker can reliably trigger the race by running concurrent netlink threads that replace a nexthop while deleting IPv6 routes bound to it; both sides of the race are attacker-controlled, as demonstrated by the reported KASAN reproducers.\nPR:L - All vulnerable rtnetlink handlers require CAP_NET_ADMIN via netlink_net_capable(), which unprivileged local users can obtain inside a user/network namespace (unshare -Urn), not only real init-namespace root.\nUI:N - Exploitation requires no victim interaction beyond the attacker issuing coordinated netlink configuration commands from local processes.\nS:C - A successful UAF from CAP_NET_ADMIN inside a user/network namespace can corrupt host kernel memory and escape the container sandbox to compromise the host system.\nC:H - The race performs use-after-free reads of freed fib6_info objects (e.g., fib6_src and fib6_flags in fib6_check_nh_list and rt6_fill_node), enabling arbitrary kernel memory disclosure via heap reuse.\nI:H - Slab UAF on fib6_info during nexthop replace notification can be leveraged with heap spraying for arbitrary kernel writes and local privilege escalation to host root.\nA:H - The bug provably causes slab-use-after-free kernel oops (KASAN) during route notification and can panic or hang the system when triggered repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:41.938Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb2b072c619c1f741a6234257050f72005dc63ef"
},
{
"url": "https://git.kernel.org/stable/c/072cd1f21819dedd2252e704d255de3b0cfc61a7"
}
],
"title": "nexthop: take nh-\u003elock for f6i_list walks in replace check and notify",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74562",
"datePublished": "2026-08-15T12:28:05.154Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:41.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74561 (GCVE-0-2026-74561)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
Summary
In the Linux kernel, the following vulnerability has been resolved:
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop
replace without holding nh->lock, racing the unlocked IPv6 route
add/delete that mutate the list under nh->lock and free fib6_info
entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):
BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)
Read of size 8 at addr ffff888012953e18 by task exploit/146
nh_rt_cache_flush (net/ipv4/nexthop.c:2243)
replace_nexthop (net/ipv4/nexthop.c:2610)
rtm_new_nexthop (net/ipv4/nexthop.c:3323)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
Unlike the other f6i_list walks, this one bumps each route's sernum via
fib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock
around it would invert the established tb6_lock -> nh->lock order and
deadlock. As the only purpose is to invalidate cached dsts, bump the
IPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,
mirroring the rt_cache_flush() already done for IPv4 just above.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
081efd18326e353c6fbfdeff903a83edde953f72 , < 44f53e4331a30fabc38a411fae7524341b618db3
(git)
Affected: 081efd18326e353c6fbfdeff903a83edde953f72 , < 4787a6d2629b4e8c0b6bacab1f75c1660eca44d9 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44f53e4331a30fabc38a411fae7524341b618db3",
"status": "affected",
"version": "081efd18326e353c6fbfdeff903a83edde953f72",
"versionType": "git"
},
{
"lessThan": "4787a6d2629b4e8c0b6bacab1f75c1660eca44d9",
"status": "affected",
"version": "081efd18326e353c6fbfdeff903a83edde953f72",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh-\u003ef6i_list during an RTNL-serialized nexthop\nreplace without holding nh-\u003elock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh-\u003elock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n Read of size 8 at addr ffff888012953e18 by task exploit/146\n nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n replace_nexthop (net/ipv4/nexthop.c:2610)\n rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route\u0027s sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh-\u003elock\naround it would invert the established tb6_lock -\u003e nh-\u003elock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The slab use-after-free is reached only via local RTNETLINK on AF_NETLINK sockets: RTM_NEWNEXTHOP with NLM_F_REPLACE drives replace_nexthop()-\u003enh_rt_cache_flush(), racing concurrent RTM_NEWROUTE/RTM_DELROUTE IPv6 route changes; it is not triggered by remote packet processing.\nAC:L - The race is attacker-controlled: one thread replaces a nexthop under rtnl_net_lock while another concurrently adds/deletes IPv6 routes via unlocked inet6_rtm_newroute/inet6_rtm_delroute handlers; Microsoft reproduced reliable KASAN slab-use-after-free with this pattern.\nPR:L - rtnetlink_rcv_msg() requires CAP_NET_ADMIN via netlink_net_capable() for all non-GET handlers; unprivileged local users obtain this inside a user/network namespace (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through coordinated local netlink nexthop replace and IPv6 route add/delete commands from attacker-controlled processes.\nS:C - A successful UAF from CAP_NET_ADMIN inside an unprivileged user/network namespace corrupts host kernel slab memory and can escape the namespace/container sandbox to compromise the host system, crossing the container-to-host security boundary.\nC:H - The unlocked nh-\u003ef6i_list walk dereferences freed fib6_info objects (KASAN read of size 8 at nh_rt_cache_flush), enabling arbitrary kernel memory disclosure via slab heap reuse of attacker-groomed objects.\nI:H - Beyond the UAF read, fib6_update_sernum_upto_root() writes fn_sernum through stale fib6_info/fib6_table pointers; slab UAF on fib6_info provides memory corruption primitives for arbitrary kernel writes and local privilege escalation.\nA:H - The confirmed KASAN slab-use-after-free in nh_rt_cache_flush during nexthop replace causes kernel oops/panic; UAF list walks are inherently crash-prone and can be triggered repeatedly for denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:40.842Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3"
},
{
"url": "https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9"
}
],
"title": "nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74561",
"datePublished": "2026-08-15T12:28:04.525Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:40.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74560 (GCVE-0-2026-74560)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:21
VLAI
EPSS
VEX
Title
xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
This patch is inspired by the check[1] from sashiko. It says when
overflow happens, the address of cq to be published is invalid.
Actually the severer thing is the whole process of publishing the
address of cq in this particular case is not right: it should truely
publish the address and advance the cached_prod in cq as long as it
reads descriptors from txq.
The following is the full analysis.
xsk_drop_skb() is called in three places, which all discard a partially
built multi-buffer skb:
1) xsk_build_skb() -EOVERFLOW error path: packet exceeds MAX_SKB_FRAGS
2) __xsk_generic_xmit() post-loop cleanup: an invalid descriptor in
the TX ring prevents the partial packet from completing
3) xsk_release(): socket close while xs->skb holds an incomplete packet
In all three cases, the TX descriptors for the already-processed frags
have been consumed from the TX ring (xskq_cons_release), and CQ slots
have been reserved. However, xsk_drop_skb() calls xsk_consume_skb()
which cancels the CQ reservations via xsk_cq_cancel_locked(). Since
the buffer addresses never appear in the completion queue, userspace
permanently loses track of these buffers.
Fix this by letting consume_skb() trigger the existing xsk_destruct_skb
destructor, which already submits buffer addresses to the CQ via
xsk_cq_submit_addr_locked().
Note that cancelling the descriptors back to the TX ring (via
xskq_cons_cancel_n) is not a appropriate option because an oversized
packet that always exceeds MAX_SKB_FRAGS would be retried indefinitely,
which is an obviously deadlock bug in the TX path.
Also move the desc->addr assignment in xsk_build_skb() above the
overflow check so that the current descriptor's address is recorded
before a potential -EOVERFLOW jump to free_err, consistent with the
zerocopy path in xsk_build_skb_zerocopy().
[1]: https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < 05e283466b86e0b25a5209a3eafe87aa9886064a
(git)
Affected: cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < a0528ab6af62bf57153caaf8ea28e5fcb0e18fd4 (git) Affected: cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < a3c8382ebce4780c6b3ace2c09bc342313ac0186 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05e283466b86e0b25a5209a3eafe87aa9886064a",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "a0528ab6af62bf57153caaf8ea28e5fcb0e18fd4",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "a3c8382ebce4780c6b3ace2c09bc342313ac0186",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx\n\nThis patch is inspired by the check[1] from sashiko. It says when\noverflow happens, the address of cq to be published is invalid.\nActually the severer thing is the whole process of publishing the\naddress of cq in this particular case is not right: it should truely\npublish the address and advance the cached_prod in cq as long as it\nreads descriptors from txq.\n\nThe following is the full analysis.\nxsk_drop_skb() is called in three places, which all discard a partially\nbuilt multi-buffer skb:\n1) xsk_build_skb() -EOVERFLOW error path: packet exceeds MAX_SKB_FRAGS\n2) __xsk_generic_xmit() post-loop cleanup: an invalid descriptor in\n the TX ring prevents the partial packet from completing\n3) xsk_release(): socket close while xs-\u003eskb holds an incomplete packet\n\nIn all three cases, the TX descriptors for the already-processed frags\nhave been consumed from the TX ring (xskq_cons_release), and CQ slots\nhave been reserved. However, xsk_drop_skb() calls xsk_consume_skb()\nwhich cancels the CQ reservations via xsk_cq_cancel_locked(). Since\nthe buffer addresses never appear in the completion queue, userspace\npermanently loses track of these buffers.\n\nFix this by letting consume_skb() trigger the existing xsk_destruct_skb\ndestructor, which already submits buffer addresses to the CQ via\nxsk_cq_submit_addr_locked().\n\nNote that cancelling the descriptors back to the TX ring (via\nxskq_cons_cancel_n) is not a appropriate option because an oversized\npacket that always exceeds MAX_SKB_FRAGS would be retried indefinitely,\nwhich is an obviously deadlock bug in the TX path.\n\nAlso move the desc-\u003eaddr assignment in xsk_build_skb() above the\noverflow check so that the current descriptor\u0027s address is recorded\nbefore a potential -EOVERFLOW jump to free_err, consistent with the\nzerocopy path in xsk_build_skb_zerocopy().\n\n[1]: https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:21:47.344Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05e283466b86e0b25a5209a3eafe87aa9886064a"
},
{
"url": "https://git.kernel.org/stable/c/a0528ab6af62bf57153caaf8ea28e5fcb0e18fd4"
},
{
"url": "https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186"
}
],
"title": "xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74560",
"datePublished": "2026-08-15T12:28:03.912Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:21:47.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74559 (GCVE-0-2026-74559)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:21
VLAI
EPSS
VEX
Title
xsk: drain continuation descs after overflow in xsk_build_skb()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: drain continuation descs after overflow in xsk_build_skb()
Fix generic xmit path multi-buffer logic when packets are either too big
(count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is
included in fragmented packet. Introduce xdp_sock::drain_cont and act
upon this flag - when it is set, keep on consuming descriptors from
AF_XDP Tx ring and put them directly onto Cq. Previously these
descriptors were silently lost and could never be reached again.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < ceb00cb87a22c42d20c39336213db2b843ca9e34
(git)
Affected: cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < 5e94d74e4f3baebaa083288f33b4be7ce0a34982 (git) Affected: cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < bd44a6dcd4248883de90f5dad53ae80066e27096 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ceb00cb87a22c42d20c39336213db2b843ca9e34",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "5e94d74e4f3baebaa083288f33b4be7ce0a34982",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "bd44a6dcd4248883de90f5dad53ae80066e27096",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: drain continuation descs after overflow in xsk_build_skb()\n\nFix generic xmit path multi-buffer logic when packets are either too big\n(count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is\nincluded in fragmented packet. Introduce xdp_sock::drain_cont and act\nupon this flag - when it is set, keep on consuming descriptors from\nAF_XDP Tx ring and put them directly onto Cq. Previously these\ndescriptors were silently lost and could never be reached again."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:21:46.240Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ceb00cb87a22c42d20c39336213db2b843ca9e34"
},
{
"url": "https://git.kernel.org/stable/c/5e94d74e4f3baebaa083288f33b4be7ce0a34982"
},
{
"url": "https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096"
}
],
"title": "xsk: drain continuation descs after overflow in xsk_build_skb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74559",
"datePublished": "2026-08-15T12:28:03.279Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:21:46.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74558 (GCVE-0-2026-74558)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:21
VLAI
EPSS
VEX
Title
xsk: reclaim invalid Tx descriptors in ZC batch path
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: reclaim invalid Tx descriptors in ZC batch path
The zero-copy Tx batch parser stops when it encounters an invalid
descriptor. If this happens after one or more continuation descriptors,
the Tx consumer can be advanced past fragments that are neither submitted
to the driver nor returned to userspace through the completion ring.
A similar problem occurs when a packet exceeds xdp_zc_max_segs. The
descriptors consumed up to the limit are released without completion, and
the remaining continuation descriptors can subsequently be interpreted
as the beginning of another packet.
Parse Tx batches in packet units and distinguish descriptors belonging to
complete valid packets from descriptors consumed while draining an
invalid or oversized packet. Return the former to the driver and append
the latter to the CQ address area so userspace can reclaim their UMEM
frames.
Treat a standalone invalid descriptor as a one-descriptor reclaim-only
packet. Advancing the Tx-ring consumer releases the ring slot, but does
not by itself return ownership of the referenced UMEM frame to userspace.
Once draining starts, continue until the packet's end-of-packet
descriptor is consumed. Preserve the drain state on the socket when EOP
has not yet been supplied, so draining can continue during a later call.
Leave incomplete but otherwise valid packets on the Tx ring.
Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing.
Walk their Tx sockets one packet at a time, preserving the existing
per-socket fairness scheme, instead of using the legacy one-descriptor
fallback. Keep that fallback for shared pools that do not use
multi-buffer Tx. Since the drain state is maintained per socket and both
the singular and shared paths can resume an interrupted drain, changing
the socket list from singular to shared requires no special bind-time
transition.
CQ entries are positional, and drivers may complete only part of the Tx
work returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only
entries cannot be published immediately when earlier driver-visible
descriptors are still outstanding.
Track the number of driver-visible CQ entries preceding the reclaim
entries. Let xsk_tx_completed() publish partial hardware Tx completions,
and publish the reclaim entries only after every earlier Tx descriptor
has completed. Complete a reclaim-only batch immediately when there is no
driver-visible work in front of it, and prevent another Tx batch from
being appended while reclaim entries remain pending.
Also cap batch processing by the size of the pool's temporary descriptor
array, as Tx rings belonging to sockets sharing a UMEM may have different
sizes.
This ensures that every invalid Tx descriptor consumed by the ZC batch
path is either submitted to the driver as part of a valid packet or
returned to userspace without violating CQ completion ordering.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < e7ce2bad0c33471c8da4dd73dff2119a68f96f3a
(git)
Affected: cf24f5a5feeaae34c1a34d1e04f8ac697290427a , < 72f2b4516faf55d4dfac2414649d3cffa5fd2c5e (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/networking/af_xdp.rst",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk.c",
"net/xdp/xsk_buff_pool.c",
"net/xdp/xsk_queue.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7ce2bad0c33471c8da4dd73dff2119a68f96f3a",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "72f2b4516faf55d4dfac2414649d3cffa5fd2c5e",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/networking/af_xdp.rst",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk.c",
"net/xdp/xsk_buff_pool.c",
"net/xdp/xsk_queue.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: reclaim invalid Tx descriptors in ZC batch path\n\nThe zero-copy Tx batch parser stops when it encounters an invalid\ndescriptor. If this happens after one or more continuation descriptors,\nthe Tx consumer can be advanced past fragments that are neither submitted\nto the driver nor returned to userspace through the completion ring.\n\nA similar problem occurs when a packet exceeds xdp_zc_max_segs. The\ndescriptors consumed up to the limit are released without completion, and\nthe remaining continuation descriptors can subsequently be interpreted\nas the beginning of another packet.\n\nParse Tx batches in packet units and distinguish descriptors belonging to\ncomplete valid packets from descriptors consumed while draining an\ninvalid or oversized packet. Return the former to the driver and append\nthe latter to the CQ address area so userspace can reclaim their UMEM\nframes.\n\nTreat a standalone invalid descriptor as a one-descriptor reclaim-only\npacket. Advancing the Tx-ring consumer releases the ring slot, but does\nnot by itself return ownership of the referenced UMEM frame to userspace.\n\nOnce draining starts, continue until the packet\u0027s end-of-packet\ndescriptor is consumed. Preserve the drain state on the socket when EOP\nhas not yet been supplied, so draining can continue during a later call.\nLeave incomplete but otherwise valid packets on the Tx ring.\n\nShared-UMEM pools using multi-buffer Tx also need packet-framed parsing.\nWalk their Tx sockets one packet at a time, preserving the existing\nper-socket fairness scheme, instead of using the legacy one-descriptor\nfallback. Keep that fallback for shared pools that do not use\nmulti-buffer Tx. Since the drain state is maintained per socket and both\nthe singular and shared paths can resume an interrupted drain, changing\nthe socket list from singular to shared requires no special bind-time\ntransition.\n\nCQ entries are positional, and drivers may complete only part of the Tx\nwork returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only\nentries cannot be published immediately when earlier driver-visible\ndescriptors are still outstanding.\n\nTrack the number of driver-visible CQ entries preceding the reclaim\nentries. Let xsk_tx_completed() publish partial hardware Tx completions,\nand publish the reclaim entries only after every earlier Tx descriptor\nhas completed. Complete a reclaim-only batch immediately when there is no\ndriver-visible work in front of it, and prevent another Tx batch from\nbeing appended while reclaim entries remain pending.\n\nAlso cap batch processing by the size of the pool\u0027s temporary descriptor\narray, as Tx rings belonging to sockets sharing a UMEM may have different\nsizes.\n\nThis ensures that every invalid Tx descriptor consumed by the ZC batch\npath is either submitted to the driver as part of a valid packet or\nreturned to userspace without violating CQ completion ordering."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:21:45.142Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7ce2bad0c33471c8da4dd73dff2119a68f96f3a"
},
{
"url": "https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e"
}
],
"title": "xsk: reclaim invalid Tx descriptors in ZC batch path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74558",
"datePublished": "2026-08-15T12:28:02.628Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:21:45.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74557 (GCVE-0-2026-74557)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the
target-supplied data segment. The segment carries a 2-byte sense length
followed by the sense bytes, so it must hold 2 + senselen bytes, but the
bounds check only requires datalen >= senselen:
senselen = get_unaligned_be16(data);
if (datalen < senselen)
goto invalid_datalen;
memcpy(sc->sense_buffer, data + 2,
min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
A target that returns a SCSI Response whose datalen equals senselen
(with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +
2 read up to two bytes past the received data. Those bytes are stale
conn->data contents and end up in the command's sense buffer, which is
returned to userspace.
Account for the 2-byte sense length prefix in the check.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 7567f06abdefb1caf2d836107c4d08c5185c650e
(git)
Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 60499924faf4ef97e84228c20515218ef121facf (git) Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 3ef209ca0b4b68c75e9a814d90cc916026b5a6ac (git) Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 1f07a897d43c63e6c9458bf77450defef39b5833 (git) Affected: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 , < 98b87885de4b7f605533a2860685f5689fce8e82 (git) |
|
| Linux | Linux |
Affected:
2.6.18
Unaffected: 0 , < 2.6.18 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7567f06abdefb1caf2d836107c4d08c5185c650e",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "60499924faf4ef97e84228c20515218ef121facf",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "3ef209ca0b4b68c75e9a814d90cc916026b5a6ac",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "1f07a897d43c63e6c9458bf77450defef39b5833",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "98b87885de4b7f605533a2860685f5689fce8e82",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Fix stale-data leak into the SCSI sense buffer\n\niscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the\ntarget-supplied data segment. The segment carries a 2-byte sense length\nfollowed by the sense bytes, so it must hold 2 + senselen bytes, but the\nbounds check only requires datalen \u003e= senselen:\n\n\tsenselen = get_unaligned_be16(data);\n\tif (datalen \u003c senselen)\n\t\tgoto invalid_datalen;\n\tmemcpy(sc-\u003esense_buffer, data + 2,\n\t min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));\n\nA target that returns a SCSI Response whose datalen equals senselen\n(with senselen \u003c= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +\n2 read up to two bytes past the received data. Those bytes are stale\nconn-\u003edata contents and end up in the command\u0027s sense buffer, which is\nreturned to userspace.\n\nAccount for the 2-byte sense length prefix in the check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote malicious or compromised iSCSI target can trigger the bug by sending a crafted SCSI Command Response over the standard iSCSI/TCP session to a Linux kernel initiator, with no local access required on the victim host.\nAC:L - The attacker fully controls the response PDU fields (datalen, sense length, CHECK_CONDITION status) and can reliably set datalen equal to senselen so the flawed bounds check passes and stale conn-\u003edata bytes are copied into the sense buffer.\nPR:N - Exploitation requires only the ability to act as the iSCSI target on the network; the attacker needs no local account, capabilities, or privileges on the victim system initiating the connection.\nUI:N - Once an iSCSI session exists, the leak is triggered automatically on SCSI command responses with no further victim action; the attacker does not rely on a user opening a file, clicking a link, or performing any interactive step at exploit time.\nS:U - The flaw discloses kernel memory contents into a SCSI sense buffer returned within the same host security domain; it does not cross VM, hypervisor, or IOMMU boundaries and is a standard kernel-to-userspace information leak.\nC:H - The out-of-bounds memcpy reads up to two bytes per response from stale conn-\u003edata kernel heap memory into sc-\u003esense_buffer, which is copied to userspace via SCSI completion, ioctl, and BSG paths, enabling repeated kernel information disclosure.\nI:N - The vulnerability is a read-only out-of-bounds memcpy from the receive buffer into the sense buffer; it does not corrupt kernel structures, overwrite memory, or provide a write or code-execution primitive.\nA:N - The bug causes no kernel panic, oops, or hang; invalid responses are handled gracefully and exploitation only leaks data into the sense buffer without disrupting system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:39.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7567f06abdefb1caf2d836107c4d08c5185c650e"
},
{
"url": "https://git.kernel.org/stable/c/60499924faf4ef97e84228c20515218ef121facf"
},
{
"url": "https://git.kernel.org/stable/c/3ef209ca0b4b68c75e9a814d90cc916026b5a6ac"
},
{
"url": "https://git.kernel.org/stable/c/1f07a897d43c63e6c9458bf77450defef39b5833"
},
{
"url": "https://git.kernel.org/stable/c/98b87885de4b7f605533a2860685f5689fce8e82"
}
],
"title": "scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74557",
"datePublished": "2026-08-15T12:28:01.988Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:39.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74556 (GCVE-0-2026-74556)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
iscsi_tcp_hdr_dissect() receives the data segment of several PDU types
into the fixed-size conn->data buffer, which is allocated for
ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,
REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU
whose DataSegmentLength exceeds that buffer.
The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its
data segment (sense/response data) into conn->data via
iscsi_tcp_data_recv_prep(), but it does so without the same check. The
only upstream bound on in.datalen is conn->max_recv_dlength, the
initiator's advertised MaxRecvDataSegmentLength, which is commonly
negotiated well above 8192 (open-iscsi defaults to 262144). A target
that returns a SCSI Response with a DataSegmentLength between 8193 and
max_recv_dlength therefore overflows the 8192-byte conn->data buffer.
Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly
like those responses: bound the data segment, receive it into conn->data
when present, and otherwise complete the PDU with no data. Fold the
opcode into that case group rather than duplicating the check.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a081c13e39b5c17052a7b46fafa61019c4c110ff , < c97b5265cc47775f77fd2a23d6bde0426997b233
(git)
Affected: a081c13e39b5c17052a7b46fafa61019c4c110ff , < 084af0253673425ce2ae62e3c7f74f0dd023711b (git) Affected: a081c13e39b5c17052a7b46fafa61019c4c110ff , < 72815741715bd41556dac5eeb068bf0f8af06ee7 (git) Affected: a081c13e39b5c17052a7b46fafa61019c4c110ff , < b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676 (git) Affected: a081c13e39b5c17052a7b46fafa61019c4c110ff , < c1dea15f819cded9b3faf58f8bec72323568b6e6 (git) |
|
| Linux | Linux |
Affected:
2.6.29
Unaffected: 0 , < 2.6.29 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c97b5265cc47775f77fd2a23d6bde0426997b233",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "084af0253673425ce2ae62e3c7f74f0dd023711b",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "72815741715bd41556dac5eeb068bf0f8af06ee7",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "c1dea15f819cded9b3faf58f8bec72323568b6e6",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn-\u003edata buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn-\u003edata via\niscsi_tcp_data_recv_prep(), but it does so without the same check. The\nonly upstream bound on in.datalen is conn-\u003emax_recv_dlength, the\ninitiator\u0027s advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144). A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn-\u003edata buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn-\u003edata\nwhen present, and otherwise complete the PDU with no data. Fold the\nopcode into that case group rather than duplicating the check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn-\u003edata buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn-\u003edata allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn-\u003edata heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:38.659Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233"
},
{
"url": "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b"
},
{
"url": "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7"
},
{
"url": "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676"
},
{
"url": "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6"
}
],
"title": "scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74556",
"datePublished": "2026-08-15T12:28:01.359Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:38.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74555 (GCVE-0-2026-74555)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:21
VLAI
EPSS
VEX
Title
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue
for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock:
the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,
calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI
devices and waits for the host to become runtime-active. But the host
cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the
drain is blocked on that very handler.
However skipping the drain reintroduces a race: hisi_sas returns from
resume before all PHY UP work and libsas discovery work finish. The
controller may then autosuspend while disks are still waking up. The
disks issue IO to a suspended controller, the IO fails, and the disks
get disabled.
Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT
notification to after sas_drain_work(). By then the host resume is about
to complete, so device removal through device_link no longer blocks on
the resume and the cycle is broken.
With the deadlock gone, restore sas_resume_ha() (the draining variant)
in hisi_sas and remove sas_resume_ha_no_sync().
The reorder is safe for the other libsas consumers (isci, pm8001,
aic94xx, mvsas). During suspend, sas_suspend_devices() calls
sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to
NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a
timed-out phy's disk is immediately rejected by the LLDD before reaching
hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET),
and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both
complete directly via scsi_done() without entering SCSI EH. This is
identical in both the old and new ordering since lldd_dev_gone runs
during suspend, before resume. The reorder only affects when the
PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work()
vs. asynchronous after resume returns), not whether I/O can reach the
device. aic94xx and mvsas do not register any PM ops and never reach
this code path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fbefe22811c3140a686e407e114789ebf328a9a2 , < e50a6523a603594a6d92cdecfe11997d639410a3
(git)
Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < c391b5899dd46485a5893696c12ae3e95a3a7325 (git) Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < 9e24b47ef81d43b3fb1b14294f09991640c79fcc (git) Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < b9c44a14062093e9fc2d6bddc696cfceadb482d7 (git) Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c",
"drivers/scsi/libsas/sas_init.c",
"include/scsi/libsas.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e50a6523a603594a6d92cdecfe11997d639410a3",
"status": "affected",
"version": "fbefe22811c3140a686e407e114789ebf328a9a2",
"versionType": "git"
},
{
"lessThan": "c391b5899dd46485a5893696c12ae3e95a3a7325",
"status": "affected",
"version": "fbefe22811c3140a686e407e114789ebf328a9a2",
"versionType": "git"
},
{
"lessThan": "9e24b47ef81d43b3fb1b14294f09991640c79fcc",
"status": "affected",
"version": "fbefe22811c3140a686e407e114789ebf328a9a2",
"versionType": "git"
},
{
"lessThan": "b9c44a14062093e9fc2d6bddc696cfceadb482d7",
"status": "affected",
"version": "fbefe22811c3140a686e407e114789ebf328a9a2",
"versionType": "git"
},
{
"lessThan": "3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845",
"status": "affected",
"version": "fbefe22811c3140a686e407e114789ebf328a9a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c",
"drivers/scsi/libsas/sas_init.c",
"include/scsi/libsas.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race\n\nCommit fbefe22811c3 (\"scsi: libsas: Don\u0027t always drain event workqueue\nfor HA resume\") introduced sas_resume_ha_no_sync() to avoid a deadlock:\nthe PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,\ncalls sas_deform_port() -\u003e sas_destruct_devices(), which removes SCSI\ndevices and waits for the host to become runtime-active. But the host\ncannot resume until sas_resume_ha() -\u003e sas_drain_work() returns, and the\ndrain is blocked on that very handler.\n\nHowever skipping the drain reintroduces a race: hisi_sas returns from\nresume before all PHY UP work and libsas discovery work finish. The\ncontroller may then autosuspend while disks are still waking up. The\ndisks issue IO to a suspended controller, the IO fails, and the disks\nget disabled.\n\nFix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT\nnotification to after sas_drain_work(). By then the host resume is about\nto complete, so device removal through device_link no longer blocks on\nthe resume and the cycle is broken.\n\nWith the deadlock gone, restore sas_resume_ha() (the draining variant)\nin hisi_sas and remove sas_resume_ha_no_sync().\n\nThe reorder is safe for the other libsas consumers (isci, pm8001,\naic94xx, mvsas). During suspend, sas_suspend_devices() calls\nsas_notify_lldd_dev_gone() for each device, which sets dev-\u003elldd_dev to\nNULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a\ntimed-out phy\u0027s disk is immediately rejected by the LLDD before reaching\nhardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET),\nand pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both\ncomplete directly via scsi_done() without entering SCSI EH. This is\nidentical in both the old and new ordering since lldd_dev_gone runs\nduring suspend, before resume. The reorder only affects when the\nPHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work()\nvs. asynchronous after resume returns), not whether I/O can reach the\ndevice. aic94xx and mvsas do not register any PM ops and never reach\nthis code path."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:21:41.791Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e50a6523a603594a6d92cdecfe11997d639410a3"
},
{
"url": "https://git.kernel.org/stable/c/c391b5899dd46485a5893696c12ae3e95a3a7325"
},
{
"url": "https://git.kernel.org/stable/c/9e24b47ef81d43b3fb1b14294f09991640c79fcc"
},
{
"url": "https://git.kernel.org/stable/c/b9c44a14062093e9fc2d6bddc696cfceadb482d7"
},
{
"url": "https://git.kernel.org/stable/c/3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845"
}
],
"title": "scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74555",
"datePublished": "2026-08-15T12:28:00.729Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:21:41.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74554 (GCVE-0-2026-74554)
Vulnerability from nvd – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the
free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is
wrong: dp_peer->peer_id for an MLO peer always carries the
ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with
index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS
(256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The
intended bitmap entry also never gets cleared, so subsequent
ath12k_peer_ml_alloc() calls eventually run out of IDs.
The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and
is stored in ahsta->ml_peer_id. Use that instead.
While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so
the bitmap and ahsta->ml_peer_id stay in sync.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ee16dcf573d5e3283fda601dd4bca6bc52251017 , < 234b5cb81e6fcc1e3b31b13deff66130be55f36e
(git)
Affected: ee16dcf573d5e3283fda601dd4bca6bc52251017 , < 47abd2ca281531deee38a3b3770d885e270e9fc9 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "234b5cb81e6fcc1e3b31b13deff66130be55f36e",
"status": "affected",
"version": "ee16dcf573d5e3283fda601dd4bca6bc52251017",
"versionType": "git"
},
{
"lessThan": "47abd2ca281531deee38a3b3770d885e270e9fc9",
"status": "affected",
"version": "ee16dcf573d5e3283fda601dd4bca6bc52251017",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()\n\nath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the\nfree_ml_peer_id_map bitmap by indexing it with dp_peer-\u003epeer_id. That is\nwrong: dp_peer-\u003epeer_id for an MLO peer always carries the\nATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with\nindex \u003e= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS\n(256) bits and corrupts memory adjacent to ah-\u003efree_ml_peer_id_map. The\nintended bitmap entry also never gets cleared, so subsequent\nath12k_peer_ml_alloc() calls eventually run out of IDs.\n\nThe ID without the VALID bit is what ath12k_peer_ml_alloc() returned and\nis stored in ahsta-\u003eml_peer_id. Use that instead.\n\nWhile there, also reset ahsta-\u003eml_peer_id to ATH12K_MLO_PEER_ID_INVALID so\nthe bitmap and ahsta-\u003eml_peer_id stay in sync.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in ath12k WiFi 7 MLO peer cleanup during firmware crash recovery; an adjacent attacker associates as an MLO client (or runs a malicious MLO AP) over 802.11, creating dp_peers whose peer_id includes BIT(13), then firmware recovery invokes ath12k_mac_dp_peer_cleanup().\nAC:L - Once an MLO peer exists, recovery deterministically calls clear_bit() with index \u003e=0x2000 on every cleanup; the attacker controls association and can repeatedly induce or wait for firmware crash/recovery (MHI RDDM) without depending on uncontrollable timing or layout.\nPR:N - Exploitation requires only wireless association and firmware recovery on a host running ath12k; the remote attacker needs no local account, shell access, or Linux capabilities on the victim system.\nUI:N - On an ath12k AP the vulnerable recovery path runs without any action by the device operator beyond normal AP operation; the attacker triggers the condition solely by wireless association and crash/recovery events.\nS:U - The out-of-bounds clear_bit corrupts kernel memory in ath12k_hw/dp_hw adjacent to free_ml_peer_id_map; impact stays within kernel/driver context and does not by itself cross VM, container, or IOMMU security boundaries.\nC:H - clear_bit() with peer_id\u003e=0x2000 writes outside the 256-bit free_ml_peer_id_map into the adjacent dp_peers[] RCU pointer table, corrupting kernel pointers that can be dereferenced later for arbitrary kernel memory read primitives.\nI:H - The out-of-bounds atomic bit-clear is a kernel memory write that corrupts dp_peers[] entries used on datapath RX/TX, enabling control of freed/corrupted objects and potential arbitrary code execution, not merely a benign crash.\nA:H - Corrupted dp_peers pointers during recovery can cause kernel oops/panic on subsequent datapath use, and the bitmap slot is never freed so ath12k_peer_ml_alloc() exhausts MLO peer IDs, denying further MLO associations (DoS)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:37.563Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/234b5cb81e6fcc1e3b31b13deff66130be55f36e"
},
{
"url": "https://git.kernel.org/stable/c/47abd2ca281531deee38a3b3770d885e270e9fc9"
}
],
"title": "wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74554",
"datePublished": "2026-08-15T12:28:00.097Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:48:37.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74553 (GCVE-0-2026-74553)
Vulnerability from nvd – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:21
VLAI
EPSS
VEX
Title
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
Unlike NCT6106, NCT6116 only has three temperature registers, and with
it only three temperature source and temperature source configuration
registers. The register addresses match those of NCT6106 and can be
re-used.
The code used a separate array to list the temperature source registers
for NCT6116, but used the size of the NCT6106 register array to set
the number of registers. The NCT6106 register array provides six addresses,
while the temperature source register array for NCT6116 only provides three
addresses. This causes a KASAN report.
BUG: KASAN: global-out-of-bounds in nct6775_probe+0x936/0x46f0 [nct6775]
Read of size 2 at addr ffffffffc19561a6 by task modprobe/954
...
Call Trace:
dump_stack+0x7d/0xa7
print_address_description.constprop.0+0x1c/0x220
? __kasan_kmalloc.constprop.0+0xc9/0xd0
? __kmalloc_node_track_caller+0x194/0x5b0
? nct6775_probe+0x936/0x46f0 [nct6775]
? nct6775_probe+0x936/0x46f0 [nct6775]
...
Fix the problem by hard-coding the number of temperature and temperature
configuration registers to three for NCT6116. Drop the unnecessary
NCT6116_REG_TEMP_SOURCE array and re-use NCT6106_REG_TEMP_SOURCE.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
29c7cb485b321c024dedc168bcbb04451176b163 , < 9a87dfaa05c3c9d3a4cdb7eafc1ab4abc84f6eef
(git)
Affected: 29c7cb485b321c024dedc168bcbb04451176b163 , < 16c45bb3d3434cfb9ea264fa52090d0823240465 (git) Affected: 29c7cb485b321c024dedc168bcbb04451176b163 , < a42d727dae5701deac8bb2a75effadae7d681153 (git) Affected: 29c7cb485b321c024dedc168bcbb04451176b163 , < a7f47f5246cd6c3199e5fb2d4109cc53e766e3f0 (git) Affected: 29c7cb485b321c024dedc168bcbb04451176b163 , < b0e8adb2ccb43009796897ced09f91636685c9d3 (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/nct6775-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9a87dfaa05c3c9d3a4cdb7eafc1ab4abc84f6eef",
"status": "affected",
"version": "29c7cb485b321c024dedc168bcbb04451176b163",
"versionType": "git"
},
{
"lessThan": "16c45bb3d3434cfb9ea264fa52090d0823240465",
"status": "affected",
"version": "29c7cb485b321c024dedc168bcbb04451176b163",
"versionType": "git"
},
{
"lessThan": "a42d727dae5701deac8bb2a75effadae7d681153",
"status": "affected",
"version": "29c7cb485b321c024dedc168bcbb04451176b163",
"versionType": "git"
},
{
"lessThan": "a7f47f5246cd6c3199e5fb2d4109cc53e766e3f0",
"status": "affected",
"version": "29c7cb485b321c024dedc168bcbb04451176b163",
"versionType": "git"
},
{
"lessThan": "b0e8adb2ccb43009796897ced09f91636685c9d3",
"status": "affected",
"version": "29c7cb485b321c024dedc168bcbb04451176b163",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/nct6775-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nct6775-core) Fix number of temperature registers for NCT6116\n\nUnlike NCT6106, NCT6116 only has three temperature registers, and with\nit only three temperature source and temperature source configuration\nregisters. The register addresses match those of NCT6106 and can be\nre-used.\n\nThe code used a separate array to list the temperature source registers\nfor NCT6116, but used the size of the NCT6106 register array to set\nthe number of registers. The NCT6106 register array provides six addresses,\nwhile the temperature source register array for NCT6116 only provides three\naddresses. This causes a KASAN report.\n\nBUG: KASAN: global-out-of-bounds in nct6775_probe+0x936/0x46f0 [nct6775]\nRead of size 2 at addr ffffffffc19561a6 by task modprobe/954\n...\nCall Trace:\n dump_stack+0x7d/0xa7\n print_address_description.constprop.0+0x1c/0x220\n ? __kasan_kmalloc.constprop.0+0xc9/0xd0\n ? __kmalloc_node_track_caller+0x194/0x5b0\n ? nct6775_probe+0x936/0x46f0 [nct6775]\n ? nct6775_probe+0x936/0x46f0 [nct6775]\n...\n\nFix the problem by hard-coding the number of temperature and temperature\nconfiguration registers to three for NCT6116. Drop the unnecessary\nNCT6116_REG_TEMP_SOURCE array and re-use NCT6106_REG_TEMP_SOURCE."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:21:39.372Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9a87dfaa05c3c9d3a4cdb7eafc1ab4abc84f6eef"
},
{
"url": "https://git.kernel.org/stable/c/16c45bb3d3434cfb9ea264fa52090d0823240465"
},
{
"url": "https://git.kernel.org/stable/c/a42d727dae5701deac8bb2a75effadae7d681153"
},
{
"url": "https://git.kernel.org/stable/c/a7f47f5246cd6c3199e5fb2d4109cc53e766e3f0"
},
{
"url": "https://git.kernel.org/stable/c/b0e8adb2ccb43009796897ced09f91636685c9d3"
}
],
"title": "hwmon: (nct6775-core) Fix number of temperature registers for NCT6116",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74553",
"datePublished": "2026-08-15T12:27:59.472Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-17T05:21:39.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74552 (GCVE-0-2026-74552)
Vulnerability from nvd – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:21
VLAI
EPSS
VEX
Title
hwmon: (lm90) Only report alarms if driver is ready
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (lm90) Only report alarms if driver is ready
Userspace can read sysfs attributes before driver registration is complete,
immediately after devm_hwmon_device_register_with_info() has been called.
At that time, data->hwmon_dev is not yet initialized. This can trigger
a NULL pointer access since lm90_update_device() and with it
lm90_update_alarms_locked() will be called. This call schedules
report_work and lm90_report_alarms(), which passes the still-NULL
data->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer
dereference.
Fix the problem by only scheduling the report and alert workers
data->hwmon_dev is set.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f6d0775119fb905fb02eafa98d575cf8ee792d46 , < 4eed33c7db5c0c573928d28d8a2c003642c679b8
(git)
Affected: f6d0775119fb905fb02eafa98d575cf8ee792d46 , < 70d9a71aa407044d70b50d356b6decf6659c4d56 (git) Affected: f6d0775119fb905fb02eafa98d575cf8ee792d46 , < 075fce376cf852db9293481edce07c181a9b1f46 (git) Affected: f6d0775119fb905fb02eafa98d575cf8ee792d46 , < f0b791a006512a48b6348494cb6960598fa99a58 (git) Affected: f6d0775119fb905fb02eafa98d575cf8ee792d46 , < aa9429edf9fc0e90d6f4da19ea4b5495a54ab117 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/lm90.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4eed33c7db5c0c573928d28d8a2c003642c679b8",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "70d9a71aa407044d70b50d356b6decf6659c4d56",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "075fce376cf852db9293481edce07c181a9b1f46",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "f0b791a006512a48b6348494cb6960598fa99a58",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "aa9429edf9fc0e90d6f4da19ea4b5495a54ab117",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/lm90.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (lm90) Only report alarms if driver is ready\n\nUserspace can read sysfs attributes before driver registration is complete,\nimmediately after devm_hwmon_device_register_with_info() has been called.\nAt that time, data-\u003ehwmon_dev is not yet initialized. This can trigger\na NULL pointer access since lm90_update_device() and with it\nlm90_update_alarms_locked() will be called. This call schedules\nreport_work and lm90_report_alarms(), which passes the still-NULL\ndata-\u003ehwmon_dev to hwmon_notify_event() and triggers a NULL pointer\ndereference.\n\nFix the problem by only scheduling the report and alert workers\ndata-\u003ehwmon_dev is set."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:21:38.269Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4eed33c7db5c0c573928d28d8a2c003642c679b8"
},
{
"url": "https://git.kernel.org/stable/c/70d9a71aa407044d70b50d356b6decf6659c4d56"
},
{
"url": "https://git.kernel.org/stable/c/075fce376cf852db9293481edce07c181a9b1f46"
},
{
"url": "https://git.kernel.org/stable/c/f0b791a006512a48b6348494cb6960598fa99a58"
},
{
"url": "https://git.kernel.org/stable/c/aa9429edf9fc0e90d6f4da19ea4b5495a54ab117"
}
],
"title": "hwmon: (lm90) Only report alarms if driver is ready",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74552",
"datePublished": "2026-08-15T12:27:58.829Z",
"dateReserved": "2026-08-15T05:44:03.915Z",
"dateUpdated": "2026-08-17T05:21:38.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74579 (GCVE-0-2026-74579)
Vulnerability from cvelistv5 – Published: 2026-08-17 05:28 – Updated: 2026-08-17 05:28
VLAI
EPSS
VEX
Title
netfilter: nft_payload: fix mask build for partial field offload
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload
expression that covers only part of a header field. For a partial IPv6
address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which
is undefined on the 32-bit int operand. It also trims only one word, so
the remaining words stay 0xffffffff (and when priv_len is a multiple of 4
the trim is skipped entirely), leaving the mask covering more bytes than
the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20
shift exponent 120 is too large for 32-bit type 'int'
...
The match is byte-granular and struct nft_data is zero-initialised, so the
correct mask is simply the first priv_len bytes set to 0xff. Set those
bytes directly and drop the word/shift trimming; this removes the undefined
shift and no longer over-masks the trailing bytes.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < b19b5d2e042c294e2cc1c908dc598f9d64015396
(git)
Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < a375d8ace807767f29f276b681b6324c74929b1d (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 16b553c46e347bc9de9946c4960654d5884a86de (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 630295d5bba1d0e0f494cc459452eb0a0058c545 (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 39e88f28fb32bf02bd4b525c24c842c9cff5663d (git) Affected: 5c2b4b4f9fa5b765b927e361e3d310bcb5773015 (git) Affected: 5.9.14 , < 5.10 (semver) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b19b5d2e042c294e2cc1c908dc598f9d64015396",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "a375d8ace807767f29f276b681b6324c74929b1d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "16b553c46e347bc9de9946c4960654d5884a86de",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "630295d5bba1d0e0f494cc459452eb0a0058c545",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "39e88f28fb32bf02bd4b525c24c842c9cff5663d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"status": "affected",
"version": "5c2b4b4f9fa5b765b927e361e3d310bcb5773015",
"versionType": "git"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: fix mask build for partial field offload\n\nnft_payload_offload_mask() builds the offload match mask for a payload\nexpression that covers only part of a header field. For a partial IPv6\naddress match (field_len = 16, priv_len = 1) that shift is 1 \u003c\u003c 120, which\nis undefined on the 32-bit int operand. It also trims only one word, so\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4\nthe trim is skipped entirely), leaving the mask covering more bytes than\nthe rule matches.\n\n UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20\n shift exponent 120 is too large for 32-bit type \u0027int\u0027\n ...\n\nThe match is byte-granular and struct nft_data is zero-initialised, so the\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those\nbytes directly and drop the word/shift trimming; this removes the undefined\nshift and no longer over-masks the trailing bytes."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:28:27.768Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396"
},
{
"url": "https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d"
},
{
"url": "https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de"
},
{
"url": "https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545"
},
{
"url": "https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d"
}
],
"title": "netfilter: nft_payload: fix mask build for partial field offload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74579",
"datePublished": "2026-08-17T05:28:27.768Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:28:27.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74578 (GCVE-0-2026-74578)
Vulnerability from cvelistv5 – Published: 2026-08-16 08:20 – Updated: 2026-08-17 05:48
VLAI
EPSS
VEX
Title
crypto: algif_skcipher - force synchronous processing on trees without ctx->state
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_skcipher - force synchronous processing on trees without ctx->state
The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv
directly into the skcipher request. After io_submit() the socket lock is
dropped and the request is processed asynchronously, so a concurrent
sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request
run under an attacker-controlled IV. For CTR/stream modes this is
IV/keystream reuse and lets an unprivileged user recover the plaintext of
a concurrent operation.
Snapshotting ctx->iv into per-request storage for the async path is not
sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -
the MSG_MORE inter-chunk IV chaining is carried solely by the in-place
req->iv writeback, which a snapshot redirects into per-request memory that
af_alg_free_resources() releases on completion, silently producing wrong
output. Writing the IV back from the completion callback instead is not
possible either: that would require lock_sock() there, but the callback can
run in softirq/atomic context, so it must not sleep.
Make the operation synchronous instead, which removes both the IV race and
any writeback race. This is equivalent to the upstream resolution, commit
fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the
AIO socket path across net/ entirely and so produces the same end state for
this file. This patch deviates from that commit deliberately: rather than
removing AIO socket support tree-wide, which would be far too invasive for
stable, it removes only the AIO branch in crypto/algif_skcipher.c.
io_submit() now completes synchronously; AF_ALG async is rarely used in
practice.
The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,
and is left alone to keep the fix minimal.
Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000
after the change; MSG_MORE chunked CTR output bit-identical to single-shot.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < bf09b0be8e851f050e98da702d247c14d81b591a
(git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 73dd3bf704ca6c20639de70c08e9a10bee904a95 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < f1a87ca0843d74482402a206ea2dfb315ee9acbd (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 60eafc7b08c6689ea3ad39eff8d97aefc8a087c7 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < d7860b682da55433b5da0591b0e4c1982ecd2689 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < b05defc41b27c7d0c05c45f67bf5b91c28f93669 (git) Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < fcc77d33a34cf271702e8daafb6c593e4626776d (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/algif_skcipher.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf09b0be8e851f050e98da702d247c14d81b591a",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "73dd3bf704ca6c20639de70c08e9a10bee904a95",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "f1a87ca0843d74482402a206ea2dfb315ee9acbd",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "60eafc7b08c6689ea3ad39eff8d97aefc8a087c7",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "d7860b682da55433b5da0591b0e4c1982ecd2689",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "b05defc41b27c7d0c05c45f67bf5b91c28f93669",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
},
{
"lessThan": "fcc77d33a34cf271702e8daafb6c593e4626776d",
"status": "affected",
"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/algif_skcipher.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate\n\nThe AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-\u003eiv\ndirectly into the skcipher request. After io_submit() the socket lock is\ndropped and the request is processed asynchronously, so a concurrent\nsendmsg(ALG_SET_IV) can overwrite ctx-\u003eiv and make the in-flight request\nrun under an attacker-controlled IV. For CTR/stream modes this is\nIV/keystream reuse and lets an unprivileged user recover the plaintext of\na concurrent operation.\n\nSnapshotting ctx-\u003eiv into per-request storage for the async path is not\nsufficient. For ciphers with statesize == 0 - which includes cbc and ctr -\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place\nreq-\u003eiv writeback, which a snapshot redirects into per-request memory that\naf_alg_free_resources() releases on completion, silently producing wrong\noutput. Writing the IV back from the completion callback instead is not\npossible either: that would require lock_sock() there, but the callback can\nrun in softirq/atomic context, so it must not sleep.\n\nMake the operation synchronous instead, which removes both the IV race and\nany writeback race. This is equivalent to the upstream resolution, commit\nfcc77d33a34c (\"net: Remove support for AIO on sockets\"), which removed the\nAIO socket path across net/ entirely and so produces the same end state for\nthis file. This patch deviates from that commit deliberately: rather than\nremoving AIO socket support tree-wide, which would be far too invasive for\nstable, it removes only the AIO branch in crypto/algif_skcipher.c.\nio_submit() now completes synchronously; AF_ALG async is rarely used in\npractice.\n\nThe -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,\nand is left alone to keep the fix minimal.\n\nTested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls on an AF_ALG skcipher socket (socket/bind/accept/sendmsg plus async recvmsg, io_submit, aio_read, or io_uring read); the bug is not reachable from remote network protocols.\nAC:L - The attacker fully controls the race by running concurrent threads or syscalls on the same socket, timing async recvmsg/io_submit against sendmsg(ALG_SET_IV); pre-fix testing achieved thousands of successful IV injections in 200000 attempts.\nPR:L - Any unprivileged local user can create and use AF_ALG skcipher sockets without CAP_NET_ADMIN or init-namespace root; only standard UNIX discretionary access to the target socket FD is required, which includes same-UID multi-threaded processes.\nUI:N - Exploitation is fully attacker-driven through direct syscalls and requires no victim interaction such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to cryptographic operations on the compromised AF_ALG socket within the attacker\u0027s security context; it does not cross VM, container, or kernel-user authority boundaries like KVM escape or IOMMU bypass.\nC:H - Concurrent IV injection on CTR/stream ciphers causes keystream reuse, letting an attacker recover the full plaintext of an in-flight decrypt/encrypt on the same keyed socket even when the key never leaves kernel memory.\nI:H - Attacker-controlled IV injection corrupts in-flight cipher output and breaks MSG_MORE CBC/CTR chaining (statesize==0), silently producing attacker-influenced ciphertext/plaintext and undermining cryptographic integrity of concurrent operations.\nA:N - The flaw causes information disclosure and silent cryptographic corruption but does not kernel panic, oops, hang, or reliably deny service; availability impact is none beyond possible application-level misbehavior."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:57.219Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf09b0be8e851f050e98da702d247c14d81b591a"
},
{
"url": "https://git.kernel.org/stable/c/73dd3bf704ca6c20639de70c08e9a10bee904a95"
},
{
"url": "https://git.kernel.org/stable/c/f1a87ca0843d74482402a206ea2dfb315ee9acbd"
},
{
"url": "https://git.kernel.org/stable/c/7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd"
},
{
"url": "https://git.kernel.org/stable/c/60eafc7b08c6689ea3ad39eff8d97aefc8a087c7"
},
{
"url": "https://git.kernel.org/stable/c/d7860b682da55433b5da0591b0e4c1982ecd2689"
},
{
"url": "https://git.kernel.org/stable/c/b05defc41b27c7d0c05c45f67bf5b91c28f93669"
},
{
"url": "https://git.kernel.org/stable/c/fcc77d33a34cf271702e8daafb6c593e4626776d"
}
],
"title": "crypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74578",
"datePublished": "2026-08-16T08:20:32.055Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-17T05:48:57.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}