Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
30288 vulnerabilities found for linux_kernel by linux
CVE-2026-98164 (GCVE-0-2026-98164)
Vulnerability from nvd – Published: 2026-09-29 12:02 – Updated: 2026-10-07 06:49
VLAI
EPSS
VEX
Title
KVM: x86/mmu: Check write tracking in all address spaces
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces
kvm_gfn_is_write_tracked() checks only the supplied memslot, but page
tracking is per-address-space and shadow pages are shared across all
address spaces. With SMM, a GFN can therefore be write-tracked in one
address space and appear untracked through the other.
Check the supplied slot first, then the slot for the other address space.
This ensures all callers honor write tracking regardless of the active
address space. In particular, it prevents mmu_try_to_unsync_pages() from
marking an upper-level shadow page unsync and eventually triggering the
BUG in pte_list_remove().
[invert direction of the conditional. - Paolo]
Severity
7.1 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
699023e239658e62da6f42f47d31b54788521ec1 , < 09aa68552d2542cc6c23edd1568ac265dc5d886f
(git)
Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 429b6f43b4d8c98988fdca99e02dc156134e3d77 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < c0a9bd5fca0b5f2dea32b0fc31350e71e8648112 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < ec8fcaf354c1cbb36755d48e9f5a00c9591349e5 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 0f38453cdb2e17566ccb7c0f3dabd5bd21caca26 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09aa68552d2542cc6c23edd1568ac265dc5d886f",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "429b6f43b4d8c98988fdca99e02dc156134e3d77",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "c0a9bd5fca0b5f2dea32b0fc31350e71e8648112",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "ec8fcaf354c1cbb36755d48e9f5a00c9591349e5",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "0f38453cdb2e17566ccb7c0f3dabd5bd21caca26",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Check write tracking in all address spaces\n\nkvm_gfn_is_write_tracked() checks only the supplied memslot, but page\ntracking is per-address-space and shadow pages are shared across all\naddress spaces. With SMM, a GFN can therefore be write-tracked in one\naddress space and appear untracked through the other.\n\nCheck the supplied slot first, then the slot for the other address space.\nThis ensures all callers honor write tracking regardless of the active\naddress space. In particular, it prevents mmu_try_to_unsync_pages() from\nmarking an upper-level shadow page unsync and eventually triggering the\nBUG in pte_list_remove().\n\n[invert direction of the conditional. - Paolo]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The fix patches kvm_gfn_is_write_tracked(), called from mmu_try_to_unsync_pages() via make_spte() on a vCPU page fault. Reaching it needs a VM with an SMM address space (KVM_SET_USER_MEMORY_REGION with as_id 1) driven through KVM_RUN on /dev/kvm. No remote protocol carries the input.\nAC:L - The attacker builds every precondition: a gPT shadowed and tracked in the as_id 0 slot, then a write to that gfn while in SMM, which checks only the as_id 1 slot and unsyncs an upper-level SP. A later sync deterministically reaches pte_list_remove; no race or outside state is needed.\nPR:L - Needs only an fd on /dev/kvm (commonly 0666 or kvm group) to create the VM, its SMM memslots and its own SMM code. No init-namespace root or capability is checked on the KVM_CREATE_VM/KVM_SET_USER_MEMORY_REGION/KVM_RUN path.\nUI:N - The attacker\u0027s own process runs the VM and triggers the page fault and the later root sync (kvm_mmu_sync_roots/kvm_sync_page) on its own. No other user does anything.\nS:U - I score the local VMM-process attacker, who controls guest SMM code. A guest-only trigger would need firmware to write chosen bytes into a gPT while in SMM, which kernel code cannot demonstrate. So the impact stays within the host kernel\u0027s authority.\nC:H - Syncing an unsynced upper-level SP runs FNAME(sync_spte) on non-leaf SPTEs. shadowed_translation is uninitialised for those entries (no __GFP_ZERO), so a gfn match makes make_spte() build a huge leaf from spte_to_pfn() of the non-leaf SPTE. That maps KVM\u0027s child page-table page, and nearby host memory, readable into the guest.\nI:N - Non-leaf SPTEs from make_nonleaf_spte() lack shadow_host_writable_mask, so the bogus leaf built in sync_spte has ACC_WRITE stripped. I found no code path where this bug lets the guest write host memory.\nA:H - Otherwise sync_spte calls drop_spte() on the non-leaf SPTE with a mismatched gfn. rmap_remove() then hits KVM_BUG_ON_DATA_CORRUPTION in pte_list_remove(), a BUG_ON with mmu_lock held when CONFIG_BUG_ON_DATA_CORRUPTION=y (the BUG the fix cites), crashing the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:49:16.773Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09aa68552d2542cc6c23edd1568ac265dc5d886f"
},
{
"url": "https://git.kernel.org/stable/c/429b6f43b4d8c98988fdca99e02dc156134e3d77"
},
{
"url": "https://git.kernel.org/stable/c/d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a"
},
{
"url": "https://git.kernel.org/stable/c/c0a9bd5fca0b5f2dea32b0fc31350e71e8648112"
},
{
"url": "https://git.kernel.org/stable/c/ec8fcaf354c1cbb36755d48e9f5a00c9591349e5"
},
{
"url": "https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"
}
],
"title": "KVM: x86/mmu: Check write tracking in all address spaces",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98164",
"datePublished": "2026-09-29T12:02:12.574Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-07T06:49:16.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98163 (GCVE-0-2026-98163)
Vulnerability from nvd – Published: 2026-09-26 08:31 – Updated: 2026-10-07 06:49
VLAI
EPSS
VEX
Title
cgroup: Avoid iteration of dying tasks with zero refcount
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Avoid iteration of dying tasks with zero refcount
The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from
cgroup_task_release() to cgroup_task_free()") extended the lifetime of
tasks on the dying_tasks list.
The iterators have provision to go through dying_tasks because of
dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,
it was expected that such tasks can obtain a new reference (that is
possible before cgroup_task_release()/put_task_struct_rcu_user()).
The tasks after cgroup_task_release() and before cgroup_task_free()
are subject to race when they may or may not have ->usage count > 0.
The race window is between css_task_iter_next() invocations
when css_set_lock is released and we may arrive at a new ->task_pos.
The iterator should not attempt to resurrect tasks whose ->usage count
dropped to zero. (When that happens, __put_task_struct_rcu_cb() is
already imminent and the returned task_struct would could be used
after free.)
As for the fix, we cannot simply check the signal->live count of a task
on the dying list because that won't distinguish regular zombies waiting
to be reaped from RCU remnant tasks that are going to be free'd.
Therefore add an extra check to rule out ->usage==0 tasks from any
iteration.
The repeat: loop in css_task_iter_advance() doesn't consider ->usage
count, so add a new loop to css_task_iter_next() to skip de-used tasks
on the dying_list.
Rough illustration of the possible race
R (reader of cgroup.procs) T (thread) L (group leader)
--------------------------------- -------------------------------- --------------------------------
L exits, signal->live > 0
cgroup_task_dead(L)
css_set_skip_task_iters() // skips only cset->tasks
list_add_tail(&L->cg_list, &cset->dying_tasks)
css_task_iter_next()
take css_set_lock
css_task_iter_advance()
leader && signal->live != 0
=> it->task_pos = &L->cg_list
release css_set_lock
T exits
--signal->live == 0
cgroup_task_dead(T) // css_set_lock
release_task(T)
cgroup_task_release(T)
release_task(L) // zap_leader
cgroup_task_release(L)
put_task_struct_rcu_user(L)
...RCU...
put_task_struct(L)
L->usage = 0
/* L still on dying_tasks */
...RCU...
__put_task_struct(L)
css_task_iter_next() // another iteration
take css_set_lock
it->task_pos = &L->cg_list
get_task_struct(L)
=> addition on 0
drop css_set_lock
cgroup_task_free(L)
css_set_skip_task_iters() // dying skip comes too late
free_task(L)
cgroup_procs_show()
task_pid_vnr(L)
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 828938118d6c2bb711301748c3e39e4bed6a62f5
(git)
Affected: 260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 057dac23d329d5c5ed62352f2659a39fd46c6d4a (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "828938118d6c2bb711301748c3e39e4bed6a62f5",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
},
{
"lessThan": "057dac23d329d5c5ed62352f2659a39fd46c6d4a",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Avoid iteration of dying tasks with zero refcount\n\nThe commit 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from\ncgroup_task_release() to cgroup_task_free()\") extended the lifetime of\ntasks on the dying_tasks list.\nThe iterators have provision to go through dying_tasks because of\ndying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,\nit was expected that such tasks can obtain a new reference (that is\npossible before cgroup_task_release()/put_task_struct_rcu_user()).\nThe tasks after cgroup_task_release() and before cgroup_task_free()\nare subject to race when they may or may not have -\u003eusage count \u003e 0.\n\nThe race window is between css_task_iter_next() invocations\nwhen css_set_lock is released and we may arrive at a new -\u003etask_pos.\nThe iterator should not attempt to resurrect tasks whose -\u003eusage count\ndropped to zero. (When that happens, __put_task_struct_rcu_cb() is\nalready imminent and the returned task_struct would could be used\nafter free.)\n\nAs for the fix, we cannot simply check the signal-\u003elive count of a task\non the dying list because that won\u0027t distinguish regular zombies waiting\nto be reaped from RCU remnant tasks that are going to be free\u0027d.\nTherefore add an extra check to rule out -\u003eusage==0 tasks from any\niteration.\n\nThe repeat: loop in css_task_iter_advance() doesn\u0027t consider -\u003eusage\ncount, so add a new loop to css_task_iter_next() to skip de-used tasks\non the dying_list.\n\nRough illustration of the possible race\n\n R (reader of cgroup.procs) T (thread) L (group leader)\n --------------------------------- -------------------------------- --------------------------------\n L exits, signal-\u003elive \u003e 0\n cgroup_task_dead(L)\n css_set_skip_task_iters() // skips only cset-\u003etasks\n list_add_tail(\u0026L-\u003ecg_list, \u0026cset-\u003edying_tasks)\n css_task_iter_next()\n take css_set_lock\n css_task_iter_advance()\n leader \u0026\u0026 signal-\u003elive != 0\n =\u003e it-\u003etask_pos = \u0026L-\u003ecg_list\n release css_set_lock\n T exits\n --signal-\u003elive == 0\n\t\t\t\t cgroup_task_dead(T) // css_set_lock\n release_task(T)\n cgroup_task_release(T)\n release_task(L) // zap_leader\n cgroup_task_release(L)\n put_task_struct_rcu_user(L)\n ...RCU...\n put_task_struct(L)\n L-\u003eusage = 0\n /* L still on dying_tasks */\n ...RCU...\n __put_task_struct(L)\n css_task_iter_next() // another iteration\n take css_set_lock\n it-\u003etask_pos = \u0026L-\u003ecg_list\n get_task_struct(L)\n =\u003e addition on 0\n drop css_set_lock\n cgroup_task_free(L)\n css_set_skip_task_iters() // dying skip comes too late\n free_task(L)\n cgroup_procs_show()\n task_pid_vnr(L)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in css_task_iter_next() (kernel/cgroup/cgroup.c), reached by a local read() of a cgroup.procs/cgroup.threads seq file via cgroup_procs_start/next/show. No remote peer supplies any input to this path.\nAC:L - The attacker controls both sides of the race: one thread repeatedly reads its own cgroup.procs while the attacker\u0027s own multithreaded process exits its group leader and then its last thread, dropping the leader\u0027s -\u003eusage to zero while it stays on dying_tasks. The attacker can retry until the reader lands on that task.\nPR:L - cgroup_file_mode() makes cgroup.procs S_IRUGO, so any unprivileged local user can read it. Creating and exiting threads in their own cgroup needs no capability, so a basic local account is enough.\nUI:N - The attacker triggers the race entirely with their own processes and their own reads of cgroup.procs. No other user or administrator has to do anything.\nS:U - The use-after-free corrupts a kernel task_struct within the same kernel security authority. It does not cross a VM, IOMMU or similar boundary.\nC:H - get_task_struct() on a zero-refcount task makes the iterator keep a task_struct that free_task() releases. cgroup_procs_show() then dereferences it via task_pid_vnr(), so a reclaimed object\u0027s contents are read and reported back to userspace.\nI:H - The iterator later calls put_task_struct() on the freed task_struct, decrementing -\u003eusage in memory that may have been reallocated. This use-after-free write on reclaimed slab memory can be groomed into a corruption primitive.\nA:H - The refcount_t \"addition on 0\" warning, followed by dereferencing and releasing a freed task_struct in css_task_iter_next()/css_task_iter_end(), causes an oops, or a panic with panic_on_warn/KASAN, and an unprivileged user can repeat it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:49:15.579Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/828938118d6c2bb711301748c3e39e4bed6a62f5"
},
{
"url": "https://git.kernel.org/stable/c/057dac23d329d5c5ed62352f2659a39fd46c6d4a"
}
],
"title": "cgroup: Avoid iteration of dying tasks with zero refcount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98163",
"datePublished": "2026-09-26T08:31:50.899Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-07T06:49:15.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98162 (GCVE-0-2026-98162)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
smb/server: fix tree connection leak in smb2_tree_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix tree connection leak in smb2_tree_connect()
See the procedure below:
smb2_tree_connect
ksmbd_tree_conn_connect
xa_store(&sess->tree_conns, tree_conn->id, tree_conn)
ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)
ksmbd_share_tree_conn_inc(sc)
ksmbd_iov_pin_rsp // fail
status.ret = KSMBD_TREE_CONN_STATUS_NOMEM
// do not disconnect tree_conn
Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc
(git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 39f2032096715daae5f6fd0f587ca7a474b019df (git) Affected: f2283680a80571ca82d710bc6ecd8f8beac67d63 (git) Affected: 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 (git) Affected: 5.15.145 , < 5.16 (semver) Affected: 6.1.71 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"lessThan": "39f2032096715daae5f6fd0f587ca7a474b019df",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"status": "affected",
"version": "f2283680a80571ca82d710bc6ecd8f8beac67d63",
"versionType": "git"
},
{
"status": "affected",
"version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.71",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.71",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix tree connection leak in smb2_tree_connect()\n\nSee the procedure below:\n\n smb2_tree_connect\n ksmbd_tree_conn_connect\n xa_store(\u0026sess-\u003etree_conns, tree_conn-\u003eid, tree_conn)\n ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)\n ksmbd_share_tree_conn_inc(sc)\n ksmbd_iov_pin_rsp // fail\n status.ret = KSMBD_TREE_CONN_STATUS_NOMEM\n // do not disconnect tree_conn\n\nDisconnect the new tree connection if ksmbd_iov_pin_rsp() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:51.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc"
},
{
"url": "https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"
}
],
"title": "smb/server: fix tree connection leak in smb2_tree_connect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98162",
"datePublished": "2026-09-25T13:06:51.778Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:51.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98161 (GCVE-0-2026-98161)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-10-03 11:02
VLAI
EPSS
VEX
Title
nvdimm: pmem: keep PREFLUSH before data writes
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: pmem: keep PREFLUSH before data writes
pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the
bio data and can later overwrite the error with a successful REQ_FUA flush.
That lets data writes run after a failed preflush and can complete the bio
successfully despite the failed ordering barrier.
Run the REQ_PREFLUSH flush synchronously before touching the bio data and
complete the bio with the flush error if it fails. Keep asynchronous flush
chaining for REQ_FUA. At that point, data copy has completed and the parent
bio can wait for the chained flush bio.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c5d4355d10d414a96ca870b731756b89d068d57a , < d34c30bc994328d9cf6749b2e9a32aabd08fd076
(git)
Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < 770a90c2127220f0fc194ce909ad4f0842e141cb (git) Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < 72561ca1ab96f0f0f32737a6171641e05a318538 (git) Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < c644a2f8fef5618fcf453c591177700fd07dd024 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d34c30bc994328d9cf6749b2e9a32aabd08fd076",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "770a90c2127220f0fc194ce909ad4f0842e141cb",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "72561ca1ab96f0f0f32737a6171641e05a318538",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "c644a2f8fef5618fcf453c591177700fd07dd024",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: pmem: keep PREFLUSH before data writes\n\npmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the\nbio data and can later overwrite the error with a successful REQ_FUA flush.\nThat lets data writes run after a failed preflush and can complete the bio\nsuccessfully despite the failed ordering barrier.\n\nRun the REQ_PREFLUSH flush synchronously before touching the bio data and\ncomplete the bio with the flush error if it fails. Keep asynchronous flush\nchaining for REQ_FUA. At that point, data copy has completed and the parent\nbio can wait for the chained flush bio."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T11:02:45.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d34c30bc994328d9cf6749b2e9a32aabd08fd076"
},
{
"url": "https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb"
},
{
"url": "https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538"
},
{
"url": "https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"
}
],
"title": "nvdimm: pmem: keep PREFLUSH before data writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98161",
"datePublished": "2026-09-25T13:06:51.138Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-03T11:02:45.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98160 (GCVE-0-2026-98160)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < ff6d1ba247b5c62bdb678f1069abc86ad88a1402
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < d6158333d630a1b21d8914feaf77a6f5deb185d9 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c017ab2b0e1b60b5be94636c94720347213d78b (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 4520d673d49dabfd42c008a33889251025f7d6d5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 423574feaed192063ef0cd0813fb85425f39e539 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 737c928ff5092d7e55128a232c231248fc993777 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 911190f0b9511c3c81f2f2484414c1ae26f636b3 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 264676418b726baca7be49171e306b6aa05cceb0 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff6d1ba247b5c62bdb678f1069abc86ad88a1402",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "d6158333d630a1b21d8914feaf77a6f5deb185d9",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6c017ab2b0e1b60b5be94636c94720347213d78b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4520d673d49dabfd42c008a33889251025f7d6d5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "423574feaed192063ef0cd0813fb85425f39e539",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "737c928ff5092d7e55128a232c231248fc993777",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "911190f0b9511c3c81f2f2484414c1ae26f636b3",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "264676418b726baca7be49171e306b6aa05cceb0",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()\n\npadapter-\u003eHalData is allocated via vzalloc(), but incorrectly freed\nusing kfree() in the rtw_sdio_if1_init() error path. Using kfree() to\nrelease this vmalloc-backed buffer can lead to memory corruption.\n\nUse rtw_hal_data_deinit() to pair the free correctly and free\nHalData with vfree().\n\nThe bug was first flagged by an experimental static analysis tool we\nare developing for kernel memory-management bugs. Manual inspection\nconfirms that the issue is still present in current mainline.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\nsuitable RTL8723BS SDIO hardware to test with, no runtime testing was\nable to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:50.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff6d1ba247b5c62bdb678f1069abc86ad88a1402"
},
{
"url": "https://git.kernel.org/stable/c/d6158333d630a1b21d8914feaf77a6f5deb185d9"
},
{
"url": "https://git.kernel.org/stable/c/6c017ab2b0e1b60b5be94636c94720347213d78b"
},
{
"url": "https://git.kernel.org/stable/c/4520d673d49dabfd42c008a33889251025f7d6d5"
},
{
"url": "https://git.kernel.org/stable/c/423574feaed192063ef0cd0813fb85425f39e539"
},
{
"url": "https://git.kernel.org/stable/c/737c928ff5092d7e55128a232c231248fc993777"
},
{
"url": "https://git.kernel.org/stable/c/911190f0b9511c3c81f2f2484414c1ae26f636b3"
},
{
"url": "https://git.kernel.org/stable/c/264676418b726baca7be49171e306b6aa05cceb0"
}
],
"title": "staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98160",
"datePublished": "2026-09-25T13:06:50.521Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:50.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100079 (GCVE-0-2026-100079)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
usb: typec: ucsi: unregister debugfs entries on teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsi_register() creates per-instance debugfs entries, but
ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI
instance across remoteproc restart then try to create an already
existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and
clear ucsi->debugfs after freeing it so repeated unregister
paths remain safe.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
df0383ffad64dc09954a60873c1e202b47f08d90 , < fb7393519908befdc094be4ea913f582adbf2f7c
(git)
Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 7177c215e69658adbd2f2fc5b72e14be9208d2ba (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 1f44d001620fd3caa30619a9bc73e9d15555408b (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 62efee351566321ad72a4abaf6eb7d972590585d (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < eed73a65ab609b79d53de88cccc34b36dfe753c4 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb7393519908befdc094be4ea913f582adbf2f7c",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "7177c215e69658adbd2f2fc5b72e14be9208d2ba",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "1f44d001620fd3caa30619a9bc73e9d15555408b",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "62efee351566321ad72a4abaf6eb7d972590585d",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "eed73a65ab609b79d53de88cccc34b36dfe753c4",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: unregister debugfs entries on teardown\n\nucsi_register() creates per-instance debugfs entries, but\nucsi_unregister() keeps them around until ucsi_destroy().\n\nDrivers like ucsi_glink that unregister/register the same UCSI\ninstance across remoteproc restart then try to create an already\nexisting debugfs directory and log:\n\n debugfs: \u0027pmic_glink.ucsi.0\u0027 already exists in \u0027ucsi\u0027\n\nUnregister debugfs entries as part of ucsi_unregister(), and\nclear ucsi-\u003edebugfs after freeing it so repeated unregister\npaths remain safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb7393519908befdc094be4ea913f582adbf2f7c"
},
{
"url": "https://git.kernel.org/stable/c/7177c215e69658adbd2f2fc5b72e14be9208d2ba"
},
{
"url": "https://git.kernel.org/stable/c/1f44d001620fd3caa30619a9bc73e9d15555408b"
},
{
"url": "https://git.kernel.org/stable/c/62efee351566321ad72a4abaf6eb7d972590585d"
},
{
"url": "https://git.kernel.org/stable/c/eed73a65ab609b79d53de88cccc34b36dfe753c4"
}
],
"title": "usb: typec: ucsi: unregister debugfs entries on teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100079",
"datePublished": "2026-09-25T13:06:49.915Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100078 (GCVE-0-2026-100078)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
wifi: iwlwifi: mei: pass correct argument to function
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: pass correct argument to function
The first argument to iwl_mei_write_cyclic_buf() should be the cldev
but the q_head pointer is passed instead. Fix it.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
652291601459272d52b6ba12811f0b60b3e6444f , < 034445e19f12bb8771c58e2ecf1fbd6eac9b5fac
(git)
Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < f22ad9d1077c83718d9e6c84b71726287c1d1ad3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < ee91ae7f5815345612d8c0afd5d7efed361bcdb5 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 082b353c05b8eaf07e03fc1918c176cd3c216e25 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 905f57aefde4f4092a411c8a55856182fb1c7598 (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034445e19f12bb8771c58e2ecf1fbd6eac9b5fac",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "f22ad9d1077c83718d9e6c84b71726287c1d1ad3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "ee91ae7f5815345612d8c0afd5d7efed361bcdb5",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "082b353c05b8eaf07e03fc1918c176cd3c216e25",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "905f57aefde4f4092a411c8a55856182fb1c7598",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mei: pass correct argument to function\n\nThe first argument to iwl_mei_write_cyclic_buf() should be the cldev\nbut the q_head pointer is passed instead. Fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034445e19f12bb8771c58e2ecf1fbd6eac9b5fac"
},
{
"url": "https://git.kernel.org/stable/c/f22ad9d1077c83718d9e6c84b71726287c1d1ad3"
},
{
"url": "https://git.kernel.org/stable/c/ee91ae7f5815345612d8c0afd5d7efed361bcdb5"
},
{
"url": "https://git.kernel.org/stable/c/6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3"
},
{
"url": "https://git.kernel.org/stable/c/082b353c05b8eaf07e03fc1918c176cd3c216e25"
},
{
"url": "https://git.kernel.org/stable/c/905f57aefde4f4092a411c8a55856182fb1c7598"
}
],
"title": "wifi: iwlwifi: mei: pass correct argument to function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100078",
"datePublished": "2026-09-25T13:06:49.327Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100077 (GCVE-0-2026-100077)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
drm/msm: Recover HW before retire hung submit
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we
recover the GPU. Retiring the submit triggers BO free and that can
result in GPU pagefaults since the GPU may be actively accessing those
BOs.
To fix this, retire the submits after gpu recovery is complete in
recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < e36284257eeca13768687bf8e52f66f8ea0e8794
(git)
Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < dc64cf9d71428234389b635d142cb5fe07d57eab (git) Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < b303e1d52811de7d1bcf793560754d4df68d4a1c (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e36284257eeca13768687bf8e52f66f8ea0e8794",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "dc64cf9d71428234389b635d142cb5fe07d57eab",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "b303e1d52811de7d1bcf793560754d4df68d4a1c",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794"
},
{
"url": "https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab"
},
{
"url": "https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c"
}
],
"title": "drm/msm: Recover HW before retire hung submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100077",
"datePublished": "2026-09-25T13:06:48.707Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100076 (GCVE-0-2026-100076)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management
xmit_frame together with its xmit_buf from the driver's fixed-size
management-TX pools via alloc_mgtxmitframe(). On the normal path the frame
is handed to dump_mgntframe(), which transfers ownership and eventually
returns both objects to their pools (the frame and, for beacons, the buf
in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion
path).
Several error/edge paths return early after a successful
alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never
transferred and neither object is freed:
- issue_beacon(): beacon larger than 512 bytes
- issue_probersp(): cur_network->ie_length > MAX_IE_SZ
- issue_probersp(): kzalloc() of the SSID scratch buffer fails
- issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP
Because alloc_mgtxmitframe() removes the frame and buf from their free
lists (list_del_init) without placing them on any pending list, an
orphaned pair is on no list and referenced by nobody, so it is only
reclaimed at driver teardown. Repeated hits progressively exhaust the
management-TX pools until alloc_mgtxmitframe() returns NULL and the
interface can no longer send beacons or probe/assoc responses.
Free the frame and buffer on these paths, matching the existing correct
error handling in issue_assocreq().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c9f6a3b9fdd31a0836b681053155b5997c0156e
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < c48e5aa01525577d6b6e782962a5bfb0e1535cb5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 41b8209376dffbd7b0b85c8bc4697d9166ac62ef (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c9f6a3b9fdd31a0836b681053155b5997c0156e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c48e5aa01525577d6b6e782962a5bfb0e1535cb5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "41b8209376dffbd7b0b85c8bc4697d9166ac62ef",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths\n\nissue_beacon(), issue_probersp() and issue_asocrsp() obtain a management\nxmit_frame together with its xmit_buf from the driver\u0027s fixed-size\nmanagement-TX pools via alloc_mgtxmitframe(). On the normal path the frame\nis handed to dump_mgntframe(), which transfers ownership and eventually\nreturns both objects to their pools (the frame and, for beacons, the buf\nin rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion\npath).\n\nSeveral error/edge paths return early after a successful\nalloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never\ntransferred and neither object is freed:\n\n - issue_beacon(): beacon larger than 512 bytes\n - issue_probersp(): cur_network-\u003eie_length \u003e MAX_IE_SZ\n - issue_probersp(): kzalloc() of the SSID scratch buffer fails\n - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP\n\nBecause alloc_mgtxmitframe() removes the frame and buf from their free\nlists (list_del_init) without placing them on any pending list, an\norphaned pair is on no list and referenced by nobody, so it is only\nreclaimed at driver teardown. Repeated hits progressively exhaust the\nmanagement-TX pools until alloc_mgtxmitframe() returns NULL and the\ninterface can no longer send beacons or probe/assoc responses.\n\nFree the frame and buffer on these paths, matching the existing correct\nerror handling in issue_assocreq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.057Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e"
},
{
"url": "https://git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5"
},
{
"url": "https://git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef"
}
],
"title": "staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100076",
"datePublished": "2026-09-25T13:06:48.057Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100075 (GCVE-0-2026-100075)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 14:41
VLAI
EPSS
VEX
Title
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect
descriptor, the unwind path destroys RDMA contexts but leaves stale
n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later
sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()
can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap
allocation before returning an error.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af00051dbc9f467d4840ec709680660a3f8990fa
(git)
Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < 717ab4d0614e9446bf8e2de6229464499e4008d6 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f1f2252da52cdda912da9993f39f58783b01b38f (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < be1478849e1abb1e12dc12e14cdbf800cc6fa99a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af073bd245180393bcb15d33d3990a6bdc32593a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < bd02d644bd19a2795c018635d273d91e45d2bb95 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < b38f98e176050850f41bb6415f3a71400056623e (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:41:03.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
},
{
"url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
},
{
"url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
},
{
"url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
},
{
"url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
},
{
"url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
},
{
"url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
},
{
"url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
}
],
"title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100075",
"datePublished": "2026-09-25T13:06:47.399Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T14:41:03.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100074 (GCVE-0-2026-100074)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
bpf: Mark bpf_refcount field as unique
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf_refcount field as unique
BPF_REFCOUNT is not marked as a unique field, while it should be. Fix
this oversight.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d54730b50bae1f3119bd686d551d66f0fcc387ca , < e42cede6f90177f4f92f80d3de18f628e61d2087
(git)
Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 641f814965d733936ca3618d4d5a12a8fa9be00e (git) Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 61e655391cb19c31f94ecd4354f624c81ce4cf75 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e42cede6f90177f4f92f80d3de18f628e61d2087",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "641f814965d733936ca3618d4d5a12a8fa9be00e",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "61e655391cb19c31f94ecd4354f624c81ce4cf75",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_refcount field as unique\n\nBPF_REFCOUNT is not marked as a unique field, while it should be. Fix\nthis oversight."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.777Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087"
},
{
"url": "https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e"
},
{
"url": "https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75"
}
],
"title": "bpf: Mark bpf_refcount field as unique",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100074",
"datePublished": "2026-09-25T13:06:46.777Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98152 (GCVE-0-2026-98152)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
nvmet-rdma: fix queue leak when connect backlog is exceeded
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-rdma: fix queue leak when connect backlog is exceeded
When pending disconnecting queues exceed the backlog limit, the
connect path only drops the device reference and leaks the newly
allocated queue and its IB resources.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
204b9645536bb4a77a2cb35e6519dbf9f4ea1665 , < 186414a6a1a34e081b07e8873622f90402346235
(git)
Affected: 00eaa58988d35fd47ca8811f7f72871591f61ffb , < e48f9d1076f8c62c3969588d638602b94aaeff12 (git) Affected: 712f3268a62d0df98a7ee991cba963ced2e58007 , < 32e598324edc3ebb1ac9362d5b9fc30ce0de4873 (git) Affected: d65fe42820b890a6a4644de0a95a812471f79ad3 , < 287420cde9d6669abcd2878c344db67423eb7df6 (git) Affected: a8803c4f0ac3fa7df5551bbb5a8800c434a94357 , < 4f7cf573cdf0ee857448b9b1967d686b07c71e7d (git) Affected: badc53620fe813b3a9f727ef9526f98567c2c898 , < 60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa (git) Affected: badc53620fe813b3a9f727ef9526f98567c2c898 , < fb1ed67788e21832b614c23767a088c08cfdd2f2 (git) Affected: 5828517d17eda27f21d29ea14800c9e0a57bad11 (git) Affected: 6.12.96 , < 6.12.111 (semver) Affected: 6.18.39 , < 6.18.53 (semver) Affected: 7.1.4 , < 7.2 (semver) |
|
| Linux | Linux |
Affected:
7.2
Unaffected: 0 , < 7.2 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "186414a6a1a34e081b07e8873622f90402346235",
"status": "affected",
"version": "204b9645536bb4a77a2cb35e6519dbf9f4ea1665",
"versionType": "git"
},
{
"lessThan": "e48f9d1076f8c62c3969588d638602b94aaeff12",
"status": "affected",
"version": "00eaa58988d35fd47ca8811f7f72871591f61ffb",
"versionType": "git"
},
{
"lessThan": "32e598324edc3ebb1ac9362d5b9fc30ce0de4873",
"status": "affected",
"version": "712f3268a62d0df98a7ee991cba963ced2e58007",
"versionType": "git"
},
{
"lessThan": "287420cde9d6669abcd2878c344db67423eb7df6",
"status": "affected",
"version": "d65fe42820b890a6a4644de0a95a812471f79ad3",
"versionType": "git"
},
{
"lessThan": "4f7cf573cdf0ee857448b9b1967d686b07c71e7d",
"status": "affected",
"version": "a8803c4f0ac3fa7df5551bbb5a8800c434a94357",
"versionType": "git"
},
{
"lessThan": "60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa",
"status": "affected",
"version": "badc53620fe813b3a9f727ef9526f98567c2c898",
"versionType": "git"
},
{
"lessThan": "fb1ed67788e21832b614c23767a088c08cfdd2f2",
"status": "affected",
"version": "badc53620fe813b3a9f727ef9526f98567c2c898",
"versionType": "git"
},
{
"status": "affected",
"version": "5828517d17eda27f21d29ea14800c9e0a57bad11",
"versionType": "git"
},
{
"lessThan": "6.12.111",
"status": "affected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThan": "6.18.53",
"status": "affected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.12.96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: fix queue leak when connect backlog is exceeded\n\nWhen pending disconnecting queues exceed the backlog limit, the\nconnect path only drops the device reference and leaks the newly\nallocated queue and its IB resources."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:24.020Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/186414a6a1a34e081b07e8873622f90402346235"
},
{
"url": "https://git.kernel.org/stable/c/e48f9d1076f8c62c3969588d638602b94aaeff12"
},
{
"url": "https://git.kernel.org/stable/c/32e598324edc3ebb1ac9362d5b9fc30ce0de4873"
},
{
"url": "https://git.kernel.org/stable/c/287420cde9d6669abcd2878c344db67423eb7df6"
},
{
"url": "https://git.kernel.org/stable/c/4f7cf573cdf0ee857448b9b1967d686b07c71e7d"
},
{
"url": "https://git.kernel.org/stable/c/60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa"
},
{
"url": "https://git.kernel.org/stable/c/fb1ed67788e21832b614c23767a088c08cfdd2f2"
}
],
"title": "nvmet-rdma: fix queue leak when connect backlog is exceeded",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98152",
"datePublished": "2026-09-25T10:36:24.020Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:24.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98139 (GCVE-0-2026-98139)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
ntfs: only count successfully cleared runs when freeing clusters
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: only count successfully cleared runs when freeing clusters
ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed
whenever the error bookkeeping condition is false, which includes
cases where ntfs_bitmap_clear_run() actually failed - e.g. a second
run failing with the same errno as an earlier one, or any failure
after a non-ENOMEM error was already recorded. Since a failed
ntfs_bitmap_clear_run() rolls back its partial modifications, no
bits were cleared for that run, yet its length still inflates
vol->free_clusters, corrupting statfs output and the allocator's
free space gate.
Only count runs whose bitmap clear succeeded.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
11ccc9107dc460de28af90fac1f42404d9802735 , < 7eb97d8828e7758b9c81277f7802e740a800f78a
(git)
Affected: 11ccc9107dc460de28af90fac1f42404d9802735 , < be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/lcnalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7eb97d8828e7758b9c81277f7802e740a800f78a",
"status": "affected",
"version": "11ccc9107dc460de28af90fac1f42404d9802735",
"versionType": "git"
},
{
"lessThan": "be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e",
"status": "affected",
"version": "11ccc9107dc460de28af90fac1f42404d9802735",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/lcnalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: only count successfully cleared runs when freeing clusters\n\nntfs_cluster_free_from_rl_nolock() adds a run\u0027s length to nr_freed\nwhenever the error bookkeeping condition is false, which includes\ncases where ntfs_bitmap_clear_run() actually failed - e.g. a second\nrun failing with the same errno as an earlier one, or any failure\nafter a non-ENOMEM error was already recorded. Since a failed\nntfs_bitmap_clear_run() rolls back its partial modifications, no\nbits were cleared for that run, yet its length still inflates\nvol-\u003efree_clusters, corrupting statfs output and the allocator\u0027s\nfree space gate.\n\nOnly count runs whose bitmap clear succeeded."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:15.974Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7eb97d8828e7758b9c81277f7802e740a800f78a"
},
{
"url": "https://git.kernel.org/stable/c/be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e"
}
],
"title": "ntfs: only count successfully cleared runs when freeing clusters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98139",
"datePublished": "2026-09-25T10:36:15.974Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:15.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98138 (GCVE-0-2026-98138)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
ntfs: do not mark the volume clean in sync_fs when errors were recorded
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: do not mark the volume clean in sync_fs when errors were recorded
ntfs_put_super() and the remount-read-only path both clear the dirty bit
only when NVolErrors(vol) is false. ntfs_sync_fs() clears it
unconditionally, so any sync() on a volume that recorded an error marks
that volume clean. A volume without this set is then seen as not needing
recovery and it does not run one, so whatever went wrong is never repaired.
This change skips resetting the dirty bit when there are volume errors.
Reproduced on a volume whose $MFTMirr does not match $MFT, which sets the
error flag while leaving the mount read-write: after a write and a sync,
the on-disk volume flags read 0x0000 with this driver and 0x0001 with the
guard in place.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6251f0b0de7d645e3591931ca4c11d8322c1866f , < ca1f9933eff777a604eb664d0f9ae433b8664cbf
(git)
Affected: 6251f0b0de7d645e3591931ca4c11d8322c1866f , < 0e4c839905418d55bafe571a92533a1d1ac7b0a8 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca1f9933eff777a604eb664d0f9ae433b8664cbf",
"status": "affected",
"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
"versionType": "git"
},
{
"lessThan": "0e4c839905418d55bafe571a92533a1d1ac7b0a8",
"status": "affected",
"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: do not mark the volume clean in sync_fs when errors were recorded\n\nntfs_put_super() and the remount-read-only path both clear the dirty bit\nonly when NVolErrors(vol) is false. ntfs_sync_fs() clears it\nunconditionally, so any sync() on a volume that recorded an error marks\nthat volume clean. A volume without this set is then seen as not needing\nrecovery and it does not run one, so whatever went wrong is never repaired.\n\nThis change skips resetting the dirty bit when there are volume errors.\n\nReproduced on a volume whose $MFTMirr does not match $MFT, which sets the\nerror flag while leaving the mount read-write: after a write and a sync,\nthe on-disk volume flags read 0x0000 with this driver and 0x0001 with the\nguard in place."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:15.349Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca1f9933eff777a604eb664d0f9ae433b8664cbf"
},
{
"url": "https://git.kernel.org/stable/c/0e4c839905418d55bafe571a92533a1d1ac7b0a8"
}
],
"title": "ntfs: do not mark the volume clean in sync_fs when errors were recorded",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98138",
"datePublished": "2026-09-25T10:36:15.349Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:15.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98137 (GCVE-0-2026-98137)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
ntfs: treat any nonzero dio zero-range return as an error
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: treat any nonzero dio zero-range return as an error
ntfs_dio_zero_range() returns either 0 or a negative errno from
blkdev_issue_zeroout(); it never returns a positive value. The
zeroing failure check in ntfs_attr_fallocate() therefore never fired,
so a failed zeroing operation was silently ignored: the loop kept
going, the newly allocated clusters were folded into initialized_size
and the write could succeed leaving stale on-disk data.
Treat any nonzero return as an error and abort the allocation.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
495e90fa334828d4119061e2726af51d0a0fb4ed , < 56392b0d5290ff2b05fc673bc07803b8ae4cfd1b
(git)
Affected: 495e90fa334828d4119061e2726af51d0a0fb4ed , < 607a9478833db656e7ceac8e9e382fa4acfde545 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/attrib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56392b0d5290ff2b05fc673bc07803b8ae4cfd1b",
"status": "affected",
"version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
"versionType": "git"
},
{
"lessThan": "607a9478833db656e7ceac8e9e382fa4acfde545",
"status": "affected",
"version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/attrib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: treat any nonzero dio zero-range return as an error\n\nntfs_dio_zero_range() returns either 0 or a negative errno from\nblkdev_issue_zeroout(); it never returns a positive value. The\nzeroing failure check in ntfs_attr_fallocate() therefore never fired,\nso a failed zeroing operation was silently ignored: the loop kept\ngoing, the newly allocated clusters were folded into initialized_size\nand the write could succeed leaving stale on-disk data.\n\nTreat any nonzero return as an error and abort the allocation."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:14.744Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56392b0d5290ff2b05fc673bc07803b8ae4cfd1b"
},
{
"url": "https://git.kernel.org/stable/c/607a9478833db656e7ceac8e9e382fa4acfde545"
}
],
"title": "ntfs: treat any nonzero dio zero-range return as an error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98137",
"datePublished": "2026-09-25T10:36:14.744Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:14.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98136 (GCVE-0-2026-98136)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
ntfs: bound $AttrDef table walk to the loaded table size
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: bound $AttrDef table walk to the loaded table size
ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the
loop condition bounds only the start of each entry, not the whole entry:
for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <
vol->attrdef_size && ad->type; ++ad)
struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and
the loop body reads further fields. vol->attrdef is kvzalloc(i_size),
where i_size is the on-disk $AttrDef data size, checked in
load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose
$AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the
read of ad->type run past the allocation. Creating a file reaches this
through ntfs_attr_size_bounds_check() and reads out of bounds:
BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0
Read of size 4 at addr ffff888005833280 by task init/1
ntfs_attr_find_in_attrdef
ntfs_attr_size_bounds_check
ntfs_attr_can_be_non_resident
ntfs_attr_add
Require the whole entry to lie within attrdef_size in the loop guard, and
reject at mount a $AttrDef too small to hold one attr_def entry.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 3e2ae47b8ebc632c27e7843a4632d9a7c060885e
(git)
Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < c8504fc1245f5322af5fa5c325ab05f9cf792b87 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/attrib.c",
"fs/ntfs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e2ae47b8ebc632c27e7843a4632d9a7c060885e",
"status": "affected",
"version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
"versionType": "git"
},
{
"lessThan": "c8504fc1245f5322af5fa5c325ab05f9cf792b87",
"status": "affected",
"version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/attrib.c",
"fs/ntfs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound $AttrDef table walk to the loaded table size\n\nntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the\nloop condition bounds only the start of each entry, not the whole entry:\n\n\tfor (ad = vol-\u003eattrdef; (u8 *)ad - (u8 *)vol-\u003eattrdef \u003c\n\t\t\tvol-\u003eattrdef_size \u0026\u0026 ad-\u003etype; ++ad)\n\nstruct attr_def is 160 bytes; the guard reads ad-\u003etype at offset 128 and\nthe loop body reads further fields. vol-\u003eattrdef is kvzalloc(i_size),\nwhere i_size is the on-disk $AttrDef data size, checked in\nload_and_init_attrdef() only as 0 \u003c i_size \u003c= 0x7fffffff. A volume whose\n$AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the\nread of ad-\u003etype run past the allocation. Creating a file reaches this\nthrough ntfs_attr_size_bounds_check() and reads out of bounds:\n\n BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0\n Read of size 4 at addr ffff888005833280 by task init/1\n ntfs_attr_find_in_attrdef\n ntfs_attr_size_bounds_check\n ntfs_attr_can_be_non_resident\n ntfs_attr_add\n\nRequire the whole entry to lie within attrdef_size in the loop guard, and\nreject at mount a $AttrDef too small to hold one attr_def entry."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:14.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e2ae47b8ebc632c27e7843a4632d9a7c060885e"
},
{
"url": "https://git.kernel.org/stable/c/c8504fc1245f5322af5fa5c325ab05f9cf792b87"
}
],
"title": "ntfs: bound $AttrDef table walk to the loaded table size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98136",
"datePublished": "2026-09-25T10:36:14.106Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:14.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98135 (GCVE-0-2026-98135)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
ntfs: reject invalid sectors_per_cluster in the boot sector
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject invalid sectors_per_cluster in the boot sector
is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field
with a range test that rejects 0x81..0xf3 but accepts 0 and other
non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():
sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;
...
vol->cluster_size = vol->sector_size << sectors_per_cluster_bits;
ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the
shift is undefined:
UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39
shift exponent 4294967295 is too large for 32-bit type 'int'
This change rejects any non-power-of-two value, since it feeds the
aforementioned shift via ffs() - 1, which only yields the correct shift for a
power of two.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6251f0b0de7d645e3591931ca4c11d8322c1866f , < 7524c3145a3bac92bebbc47a29c007f1d874c9b3
(git)
Affected: 6251f0b0de7d645e3591931ca4c11d8322c1866f , < 323751a604e7533fa473874d999371592a614207 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7524c3145a3bac92bebbc47a29c007f1d874c9b3",
"status": "affected",
"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
"versionType": "git"
},
{
"lessThan": "323751a604e7533fa473874d999371592a614207",
"status": "affected",
"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: reject invalid sectors_per_cluster in the boot sector\n\nis_boot_sector_ntfs() checks the boot sector\u0027s sectors_per_cluster field\nwith a range test that rejects 0x81..0xf3 but accepts 0 and other\nnon-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():\n\n\tsectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;\n\t...\n\tvol-\u003ecluster_size = vol-\u003esector_size \u003c\u003c sectors_per_cluster_bits;\n\nffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the\nshift is undefined:\n\n UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39\n shift exponent 4294967295 is too large for 32-bit type \u0027int\u0027\n\nThis change rejects any non-power-of-two value, since it feeds the\naforementioned shift via ffs() - 1, which only yields the correct shift for a\npower of two."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:13.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7524c3145a3bac92bebbc47a29c007f1d874c9b3"
},
{
"url": "https://git.kernel.org/stable/c/323751a604e7533fa473874d999371592a614207"
}
],
"title": "ntfs: reject invalid sectors_per_cluster in the boot sector",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98135",
"datePublished": "2026-09-25T10:36:13.510Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:13.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98134 (GCVE-0-2026-98134)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
bpf: check_cond_jmp_op(): properly infer if register is null
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: check_cond_jmp_op(): properly infer if register is null
Nicholas Carlini reported a bug when verifier can incorrectly infer
that a pointer is non-null. The bug occurs when two pointers are
compared and one of them has a type w/o PTR_MAYBE_NULL flag,
but which allows a value to be NULL at runtime.
Here is an example:
// `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED
// `a` is 0 at runtime.
// `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL
void *a = bpf_rdonly_cast(0, 0);
int *b = bpf_map_lookup_elem(...);
if (a == b)
*b = 42; // verifier does not catch null pointer dereference
This happens because of a special case in check_cond_jmp_op(),
which attempts to strip PTR_MAYBE_NULL flags from pointer types,
when processing comparisons like `rA == rB`, if either rA or rB can't
be null.
The non-null property is derived based on the absence of
PTR_MAYBE_NULL flag on rA's or rB's type. But that is not sufficient
for types like PTR_TO_MEM, as in the example.
This patch replaces type_may_be_null() call with reg_not_null(),
which contains an allowlist of types for which absence of
PTR_MAYBE_NULL actually means that the value can't be NULL at runtime.
At the moment, the list in the reg_not_null() omits two types for
which PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF.
In order to remain backward compatible, and assuming that only
comparison between pointers of the same type makes sense,
this commit extends reg_not_null(). W/o such an extension e.g.
verifier_jeq_infer_not_null/null_ptr_to_map_value fails.
reg_not_null() can be extended further, but I deem that out of scope
for the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID
checks in the check_cond_jmp_op() can be removed with migration to
reg_not_null(), but that is a behavioural change, as the special case
would start matching for PTR_TO_BTF_ID that is also is_trusted_reg().
I omit the behavioural change from this commit.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
befae75856ab406a3f3fab2aa2118cf3b2dfe3e6 , < b55c9f019e169ed0d01394f96e172286a8b21b99
(git)
Affected: befae75856ab406a3f3fab2aa2118cf3b2dfe3e6 , < d3ef6c097ba078e1f8c7239d76a0ce8b61e75095 (git) |
|
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b55c9f019e169ed0d01394f96e172286a8b21b99",
"status": "affected",
"version": "befae75856ab406a3f3fab2aa2118cf3b2dfe3e6",
"versionType": "git"
},
{
"lessThan": "d3ef6c097ba078e1f8c7239d76a0ce8b61e75095",
"status": "affected",
"version": "befae75856ab406a3f3fab2aa2118cf3b2dfe3e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: check_cond_jmp_op(): properly infer if register is null\n\nNicholas Carlini reported a bug when verifier can incorrectly infer\nthat a pointer is non-null. The bug occurs when two pointers are\ncompared and one of them has a type w/o PTR_MAYBE_NULL flag,\nbut which allows a value to be NULL at runtime.\nHere is an example:\n\n // `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED\n // `a` is 0 at runtime.\n // `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL\n void *a = bpf_rdonly_cast(0, 0);\n int *b = bpf_map_lookup_elem(...);\n\n if (a == b)\n *b = 42; // verifier does not catch null pointer dereference\n\nThis happens because of a special case in check_cond_jmp_op(),\nwhich attempts to strip PTR_MAYBE_NULL flags from pointer types,\nwhen processing comparisons like `rA == rB`, if either rA or rB can\u0027t\nbe null.\n\nThe non-null property is derived based on the absence of\nPTR_MAYBE_NULL flag on rA\u0027s or rB\u0027s type. But that is not sufficient\nfor types like PTR_TO_MEM, as in the example.\n\nThis patch replaces type_may_be_null() call with reg_not_null(),\nwhich contains an allowlist of types for which absence of\nPTR_MAYBE_NULL actually means that the value can\u0027t be NULL at runtime.\n\nAt the moment, the list in the reg_not_null() omits two types for\nwhich PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF.\nIn order to remain backward compatible, and assuming that only\ncomparison between pointers of the same type makes sense,\nthis commit extends reg_not_null(). W/o such an extension e.g.\nverifier_jeq_infer_not_null/null_ptr_to_map_value fails.\n\nreg_not_null() can be extended further, but I deem that out of scope\nfor the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID\nchecks in the check_cond_jmp_op() can be removed with migration to\nreg_not_null(), but that is a behavioural change, as the special case\nwould start matching for PTR_TO_BTF_ID that is also is_trusted_reg().\nI omit the behavioural change from this commit."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:12.919Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b55c9f019e169ed0d01394f96e172286a8b21b99"
},
{
"url": "https://git.kernel.org/stable/c/d3ef6c097ba078e1f8c7239d76a0ce8b61e75095"
}
],
"title": "bpf: check_cond_jmp_op(): properly infer if register is null",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98134",
"datePublished": "2026-09-25T10:36:12.919Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:12.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98133 (GCVE-0-2026-98133)
Vulnerability from nvd – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
ntfs: leave HasEA flag untouched on setxattr failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs: leave HasEA flag untouched on setxattr failure
In ntfs_set_ea(), the exit path unconditionally updates the HasEA
flag based on ea_info_qsize. When an error occurs before
ea_info_qsize is updated, NInoClearHasEA() hides existing on-disk
EAs until the inode is evicted.
Only update the flag on success.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fc053f05ca282a5e760b41f6560ac835c4e28037 , < 5811a08310754cbf4a1122c81d14c54b8873c35c
(git)
Affected: fc053f05ca282a5e760b41f6560ac835c4e28037 , < ac727d86fb84bdc9626ba9c756c26767459f3083 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs/ea.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5811a08310754cbf4a1122c81d14c54b8873c35c",
"status": "affected",
"version": "fc053f05ca282a5e760b41f6560ac835c4e28037",
"versionType": "git"
},
{
"lessThan": "ac727d86fb84bdc9626ba9c756c26767459f3083",
"status": "affected",
"version": "fc053f05ca282a5e760b41f6560ac835c4e28037",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs/ea.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: leave HasEA flag untouched on setxattr failure\n\nIn ntfs_set_ea(), the exit path unconditionally updates the HasEA\nflag based on ea_info_qsize. When an error occurs before\nea_info_qsize is updated, NInoClearHasEA() hides existing on-disk\nEAs until the inode is evicted.\n\nOnly update the flag on success."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:12.310Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5811a08310754cbf4a1122c81d14c54b8873c35c"
},
{
"url": "https://git.kernel.org/stable/c/ac727d86fb84bdc9626ba9c756c26767459f3083"
}
],
"title": "ntfs: leave HasEA flag untouched on setxattr failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98133",
"datePublished": "2026-09-25T10:36:12.310Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:12.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98164 (GCVE-0-2026-98164)
Vulnerability from cvelistv5 – Published: 2026-09-29 12:02 – Updated: 2026-10-07 06:49
VLAI
EPSS
VEX
Title
KVM: x86/mmu: Check write tracking in all address spaces
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces
kvm_gfn_is_write_tracked() checks only the supplied memslot, but page
tracking is per-address-space and shadow pages are shared across all
address spaces. With SMM, a GFN can therefore be write-tracked in one
address space and appear untracked through the other.
Check the supplied slot first, then the slot for the other address space.
This ensures all callers honor write tracking regardless of the active
address space. In particular, it prevents mmu_try_to_unsync_pages() from
marking an upper-level shadow page unsync and eventually triggering the
BUG in pte_list_remove().
[invert direction of the conditional. - Paolo]
Severity
7.1 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
699023e239658e62da6f42f47d31b54788521ec1 , < 09aa68552d2542cc6c23edd1568ac265dc5d886f
(git)
Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 429b6f43b4d8c98988fdca99e02dc156134e3d77 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < c0a9bd5fca0b5f2dea32b0fc31350e71e8648112 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < ec8fcaf354c1cbb36755d48e9f5a00c9591349e5 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 0f38453cdb2e17566ccb7c0f3dabd5bd21caca26 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09aa68552d2542cc6c23edd1568ac265dc5d886f",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "429b6f43b4d8c98988fdca99e02dc156134e3d77",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "c0a9bd5fca0b5f2dea32b0fc31350e71e8648112",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "ec8fcaf354c1cbb36755d48e9f5a00c9591349e5",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "0f38453cdb2e17566ccb7c0f3dabd5bd21caca26",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Check write tracking in all address spaces\n\nkvm_gfn_is_write_tracked() checks only the supplied memslot, but page\ntracking is per-address-space and shadow pages are shared across all\naddress spaces. With SMM, a GFN can therefore be write-tracked in one\naddress space and appear untracked through the other.\n\nCheck the supplied slot first, then the slot for the other address space.\nThis ensures all callers honor write tracking regardless of the active\naddress space. In particular, it prevents mmu_try_to_unsync_pages() from\nmarking an upper-level shadow page unsync and eventually triggering the\nBUG in pte_list_remove().\n\n[invert direction of the conditional. - Paolo]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The fix patches kvm_gfn_is_write_tracked(), called from mmu_try_to_unsync_pages() via make_spte() on a vCPU page fault. Reaching it needs a VM with an SMM address space (KVM_SET_USER_MEMORY_REGION with as_id 1) driven through KVM_RUN on /dev/kvm. No remote protocol carries the input.\nAC:L - The attacker builds every precondition: a gPT shadowed and tracked in the as_id 0 slot, then a write to that gfn while in SMM, which checks only the as_id 1 slot and unsyncs an upper-level SP. A later sync deterministically reaches pte_list_remove; no race or outside state is needed.\nPR:L - Needs only an fd on /dev/kvm (commonly 0666 or kvm group) to create the VM, its SMM memslots and its own SMM code. No init-namespace root or capability is checked on the KVM_CREATE_VM/KVM_SET_USER_MEMORY_REGION/KVM_RUN path.\nUI:N - The attacker\u0027s own process runs the VM and triggers the page fault and the later root sync (kvm_mmu_sync_roots/kvm_sync_page) on its own. No other user does anything.\nS:U - I score the local VMM-process attacker, who controls guest SMM code. A guest-only trigger would need firmware to write chosen bytes into a gPT while in SMM, which kernel code cannot demonstrate. So the impact stays within the host kernel\u0027s authority.\nC:H - Syncing an unsynced upper-level SP runs FNAME(sync_spte) on non-leaf SPTEs. shadowed_translation is uninitialised for those entries (no __GFP_ZERO), so a gfn match makes make_spte() build a huge leaf from spte_to_pfn() of the non-leaf SPTE. That maps KVM\u0027s child page-table page, and nearby host memory, readable into the guest.\nI:N - Non-leaf SPTEs from make_nonleaf_spte() lack shadow_host_writable_mask, so the bogus leaf built in sync_spte has ACC_WRITE stripped. I found no code path where this bug lets the guest write host memory.\nA:H - Otherwise sync_spte calls drop_spte() on the non-leaf SPTE with a mismatched gfn. rmap_remove() then hits KVM_BUG_ON_DATA_CORRUPTION in pte_list_remove(), a BUG_ON with mmu_lock held when CONFIG_BUG_ON_DATA_CORRUPTION=y (the BUG the fix cites), crashing the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:49:16.773Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09aa68552d2542cc6c23edd1568ac265dc5d886f"
},
{
"url": "https://git.kernel.org/stable/c/429b6f43b4d8c98988fdca99e02dc156134e3d77"
},
{
"url": "https://git.kernel.org/stable/c/d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a"
},
{
"url": "https://git.kernel.org/stable/c/c0a9bd5fca0b5f2dea32b0fc31350e71e8648112"
},
{
"url": "https://git.kernel.org/stable/c/ec8fcaf354c1cbb36755d48e9f5a00c9591349e5"
},
{
"url": "https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"
}
],
"title": "KVM: x86/mmu: Check write tracking in all address spaces",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98164",
"datePublished": "2026-09-29T12:02:12.574Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-07T06:49:16.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98163 (GCVE-0-2026-98163)
Vulnerability from cvelistv5 – Published: 2026-09-26 08:31 – Updated: 2026-10-07 06:49
VLAI
EPSS
VEX
Title
cgroup: Avoid iteration of dying tasks with zero refcount
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Avoid iteration of dying tasks with zero refcount
The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from
cgroup_task_release() to cgroup_task_free()") extended the lifetime of
tasks on the dying_tasks list.
The iterators have provision to go through dying_tasks because of
dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,
it was expected that such tasks can obtain a new reference (that is
possible before cgroup_task_release()/put_task_struct_rcu_user()).
The tasks after cgroup_task_release() and before cgroup_task_free()
are subject to race when they may or may not have ->usage count > 0.
The race window is between css_task_iter_next() invocations
when css_set_lock is released and we may arrive at a new ->task_pos.
The iterator should not attempt to resurrect tasks whose ->usage count
dropped to zero. (When that happens, __put_task_struct_rcu_cb() is
already imminent and the returned task_struct would could be used
after free.)
As for the fix, we cannot simply check the signal->live count of a task
on the dying list because that won't distinguish regular zombies waiting
to be reaped from RCU remnant tasks that are going to be free'd.
Therefore add an extra check to rule out ->usage==0 tasks from any
iteration.
The repeat: loop in css_task_iter_advance() doesn't consider ->usage
count, so add a new loop to css_task_iter_next() to skip de-used tasks
on the dying_list.
Rough illustration of the possible race
R (reader of cgroup.procs) T (thread) L (group leader)
--------------------------------- -------------------------------- --------------------------------
L exits, signal->live > 0
cgroup_task_dead(L)
css_set_skip_task_iters() // skips only cset->tasks
list_add_tail(&L->cg_list, &cset->dying_tasks)
css_task_iter_next()
take css_set_lock
css_task_iter_advance()
leader && signal->live != 0
=> it->task_pos = &L->cg_list
release css_set_lock
T exits
--signal->live == 0
cgroup_task_dead(T) // css_set_lock
release_task(T)
cgroup_task_release(T)
release_task(L) // zap_leader
cgroup_task_release(L)
put_task_struct_rcu_user(L)
...RCU...
put_task_struct(L)
L->usage = 0
/* L still on dying_tasks */
...RCU...
__put_task_struct(L)
css_task_iter_next() // another iteration
take css_set_lock
it->task_pos = &L->cg_list
get_task_struct(L)
=> addition on 0
drop css_set_lock
cgroup_task_free(L)
css_set_skip_task_iters() // dying skip comes too late
free_task(L)
cgroup_procs_show()
task_pid_vnr(L)
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 828938118d6c2bb711301748c3e39e4bed6a62f5
(git)
Affected: 260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 057dac23d329d5c5ed62352f2659a39fd46c6d4a (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "828938118d6c2bb711301748c3e39e4bed6a62f5",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
},
{
"lessThan": "057dac23d329d5c5ed62352f2659a39fd46c6d4a",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Avoid iteration of dying tasks with zero refcount\n\nThe commit 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from\ncgroup_task_release() to cgroup_task_free()\") extended the lifetime of\ntasks on the dying_tasks list.\nThe iterators have provision to go through dying_tasks because of\ndying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,\nit was expected that such tasks can obtain a new reference (that is\npossible before cgroup_task_release()/put_task_struct_rcu_user()).\nThe tasks after cgroup_task_release() and before cgroup_task_free()\nare subject to race when they may or may not have -\u003eusage count \u003e 0.\n\nThe race window is between css_task_iter_next() invocations\nwhen css_set_lock is released and we may arrive at a new -\u003etask_pos.\nThe iterator should not attempt to resurrect tasks whose -\u003eusage count\ndropped to zero. (When that happens, __put_task_struct_rcu_cb() is\nalready imminent and the returned task_struct would could be used\nafter free.)\n\nAs for the fix, we cannot simply check the signal-\u003elive count of a task\non the dying list because that won\u0027t distinguish regular zombies waiting\nto be reaped from RCU remnant tasks that are going to be free\u0027d.\nTherefore add an extra check to rule out -\u003eusage==0 tasks from any\niteration.\n\nThe repeat: loop in css_task_iter_advance() doesn\u0027t consider -\u003eusage\ncount, so add a new loop to css_task_iter_next() to skip de-used tasks\non the dying_list.\n\nRough illustration of the possible race\n\n R (reader of cgroup.procs) T (thread) L (group leader)\n --------------------------------- -------------------------------- --------------------------------\n L exits, signal-\u003elive \u003e 0\n cgroup_task_dead(L)\n css_set_skip_task_iters() // skips only cset-\u003etasks\n list_add_tail(\u0026L-\u003ecg_list, \u0026cset-\u003edying_tasks)\n css_task_iter_next()\n take css_set_lock\n css_task_iter_advance()\n leader \u0026\u0026 signal-\u003elive != 0\n =\u003e it-\u003etask_pos = \u0026L-\u003ecg_list\n release css_set_lock\n T exits\n --signal-\u003elive == 0\n\t\t\t\t cgroup_task_dead(T) // css_set_lock\n release_task(T)\n cgroup_task_release(T)\n release_task(L) // zap_leader\n cgroup_task_release(L)\n put_task_struct_rcu_user(L)\n ...RCU...\n put_task_struct(L)\n L-\u003eusage = 0\n /* L still on dying_tasks */\n ...RCU...\n __put_task_struct(L)\n css_task_iter_next() // another iteration\n take css_set_lock\n it-\u003etask_pos = \u0026L-\u003ecg_list\n get_task_struct(L)\n =\u003e addition on 0\n drop css_set_lock\n cgroup_task_free(L)\n css_set_skip_task_iters() // dying skip comes too late\n free_task(L)\n cgroup_procs_show()\n task_pid_vnr(L)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in css_task_iter_next() (kernel/cgroup/cgroup.c), reached by a local read() of a cgroup.procs/cgroup.threads seq file via cgroup_procs_start/next/show. No remote peer supplies any input to this path.\nAC:L - The attacker controls both sides of the race: one thread repeatedly reads its own cgroup.procs while the attacker\u0027s own multithreaded process exits its group leader and then its last thread, dropping the leader\u0027s -\u003eusage to zero while it stays on dying_tasks. The attacker can retry until the reader lands on that task.\nPR:L - cgroup_file_mode() makes cgroup.procs S_IRUGO, so any unprivileged local user can read it. Creating and exiting threads in their own cgroup needs no capability, so a basic local account is enough.\nUI:N - The attacker triggers the race entirely with their own processes and their own reads of cgroup.procs. No other user or administrator has to do anything.\nS:U - The use-after-free corrupts a kernel task_struct within the same kernel security authority. It does not cross a VM, IOMMU or similar boundary.\nC:H - get_task_struct() on a zero-refcount task makes the iterator keep a task_struct that free_task() releases. cgroup_procs_show() then dereferences it via task_pid_vnr(), so a reclaimed object\u0027s contents are read and reported back to userspace.\nI:H - The iterator later calls put_task_struct() on the freed task_struct, decrementing -\u003eusage in memory that may have been reallocated. This use-after-free write on reclaimed slab memory can be groomed into a corruption primitive.\nA:H - The refcount_t \"addition on 0\" warning, followed by dereferencing and releasing a freed task_struct in css_task_iter_next()/css_task_iter_end(), causes an oops, or a panic with panic_on_warn/KASAN, and an unprivileged user can repeat it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:49:15.579Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/828938118d6c2bb711301748c3e39e4bed6a62f5"
},
{
"url": "https://git.kernel.org/stable/c/057dac23d329d5c5ed62352f2659a39fd46c6d4a"
}
],
"title": "cgroup: Avoid iteration of dying tasks with zero refcount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98163",
"datePublished": "2026-09-26T08:31:50.899Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-07T06:49:15.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98162 (GCVE-0-2026-98162)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
smb/server: fix tree connection leak in smb2_tree_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix tree connection leak in smb2_tree_connect()
See the procedure below:
smb2_tree_connect
ksmbd_tree_conn_connect
xa_store(&sess->tree_conns, tree_conn->id, tree_conn)
ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)
ksmbd_share_tree_conn_inc(sc)
ksmbd_iov_pin_rsp // fail
status.ret = KSMBD_TREE_CONN_STATUS_NOMEM
// do not disconnect tree_conn
Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc
(git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 39f2032096715daae5f6fd0f587ca7a474b019df (git) Affected: f2283680a80571ca82d710bc6ecd8f8beac67d63 (git) Affected: 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 (git) Affected: 5.15.145 , < 5.16 (semver) Affected: 6.1.71 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"lessThan": "39f2032096715daae5f6fd0f587ca7a474b019df",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"status": "affected",
"version": "f2283680a80571ca82d710bc6ecd8f8beac67d63",
"versionType": "git"
},
{
"status": "affected",
"version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.71",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.71",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix tree connection leak in smb2_tree_connect()\n\nSee the procedure below:\n\n smb2_tree_connect\n ksmbd_tree_conn_connect\n xa_store(\u0026sess-\u003etree_conns, tree_conn-\u003eid, tree_conn)\n ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)\n ksmbd_share_tree_conn_inc(sc)\n ksmbd_iov_pin_rsp // fail\n status.ret = KSMBD_TREE_CONN_STATUS_NOMEM\n // do not disconnect tree_conn\n\nDisconnect the new tree connection if ksmbd_iov_pin_rsp() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:51.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc"
},
{
"url": "https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"
}
],
"title": "smb/server: fix tree connection leak in smb2_tree_connect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98162",
"datePublished": "2026-09-25T13:06:51.778Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:51.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98161 (GCVE-0-2026-98161)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-10-03 11:02
VLAI
EPSS
VEX
Title
nvdimm: pmem: keep PREFLUSH before data writes
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: pmem: keep PREFLUSH before data writes
pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the
bio data and can later overwrite the error with a successful REQ_FUA flush.
That lets data writes run after a failed preflush and can complete the bio
successfully despite the failed ordering barrier.
Run the REQ_PREFLUSH flush synchronously before touching the bio data and
complete the bio with the flush error if it fails. Keep asynchronous flush
chaining for REQ_FUA. At that point, data copy has completed and the parent
bio can wait for the chained flush bio.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c5d4355d10d414a96ca870b731756b89d068d57a , < d34c30bc994328d9cf6749b2e9a32aabd08fd076
(git)
Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < 770a90c2127220f0fc194ce909ad4f0842e141cb (git) Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < 72561ca1ab96f0f0f32737a6171641e05a318538 (git) Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < c644a2f8fef5618fcf453c591177700fd07dd024 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d34c30bc994328d9cf6749b2e9a32aabd08fd076",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "770a90c2127220f0fc194ce909ad4f0842e141cb",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "72561ca1ab96f0f0f32737a6171641e05a318538",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "c644a2f8fef5618fcf453c591177700fd07dd024",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: pmem: keep PREFLUSH before data writes\n\npmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the\nbio data and can later overwrite the error with a successful REQ_FUA flush.\nThat lets data writes run after a failed preflush and can complete the bio\nsuccessfully despite the failed ordering barrier.\n\nRun the REQ_PREFLUSH flush synchronously before touching the bio data and\ncomplete the bio with the flush error if it fails. Keep asynchronous flush\nchaining for REQ_FUA. At that point, data copy has completed and the parent\nbio can wait for the chained flush bio."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T11:02:45.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d34c30bc994328d9cf6749b2e9a32aabd08fd076"
},
{
"url": "https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb"
},
{
"url": "https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538"
},
{
"url": "https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"
}
],
"title": "nvdimm: pmem: keep PREFLUSH before data writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98161",
"datePublished": "2026-09-25T13:06:51.138Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-03T11:02:45.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98160 (GCVE-0-2026-98160)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < ff6d1ba247b5c62bdb678f1069abc86ad88a1402
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < d6158333d630a1b21d8914feaf77a6f5deb185d9 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c017ab2b0e1b60b5be94636c94720347213d78b (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 4520d673d49dabfd42c008a33889251025f7d6d5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 423574feaed192063ef0cd0813fb85425f39e539 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 737c928ff5092d7e55128a232c231248fc993777 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 911190f0b9511c3c81f2f2484414c1ae26f636b3 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 264676418b726baca7be49171e306b6aa05cceb0 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff6d1ba247b5c62bdb678f1069abc86ad88a1402",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "d6158333d630a1b21d8914feaf77a6f5deb185d9",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6c017ab2b0e1b60b5be94636c94720347213d78b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4520d673d49dabfd42c008a33889251025f7d6d5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "423574feaed192063ef0cd0813fb85425f39e539",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "737c928ff5092d7e55128a232c231248fc993777",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "911190f0b9511c3c81f2f2484414c1ae26f636b3",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "264676418b726baca7be49171e306b6aa05cceb0",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()\n\npadapter-\u003eHalData is allocated via vzalloc(), but incorrectly freed\nusing kfree() in the rtw_sdio_if1_init() error path. Using kfree() to\nrelease this vmalloc-backed buffer can lead to memory corruption.\n\nUse rtw_hal_data_deinit() to pair the free correctly and free\nHalData with vfree().\n\nThe bug was first flagged by an experimental static analysis tool we\nare developing for kernel memory-management bugs. Manual inspection\nconfirms that the issue is still present in current mainline.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\nsuitable RTL8723BS SDIO hardware to test with, no runtime testing was\nable to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:50.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff6d1ba247b5c62bdb678f1069abc86ad88a1402"
},
{
"url": "https://git.kernel.org/stable/c/d6158333d630a1b21d8914feaf77a6f5deb185d9"
},
{
"url": "https://git.kernel.org/stable/c/6c017ab2b0e1b60b5be94636c94720347213d78b"
},
{
"url": "https://git.kernel.org/stable/c/4520d673d49dabfd42c008a33889251025f7d6d5"
},
{
"url": "https://git.kernel.org/stable/c/423574feaed192063ef0cd0813fb85425f39e539"
},
{
"url": "https://git.kernel.org/stable/c/737c928ff5092d7e55128a232c231248fc993777"
},
{
"url": "https://git.kernel.org/stable/c/911190f0b9511c3c81f2f2484414c1ae26f636b3"
},
{
"url": "https://git.kernel.org/stable/c/264676418b726baca7be49171e306b6aa05cceb0"
}
],
"title": "staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98160",
"datePublished": "2026-09-25T13:06:50.521Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:50.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100079 (GCVE-0-2026-100079)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
usb: typec: ucsi: unregister debugfs entries on teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsi_register() creates per-instance debugfs entries, but
ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI
instance across remoteproc restart then try to create an already
existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and
clear ucsi->debugfs after freeing it so repeated unregister
paths remain safe.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
df0383ffad64dc09954a60873c1e202b47f08d90 , < fb7393519908befdc094be4ea913f582adbf2f7c
(git)
Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 7177c215e69658adbd2f2fc5b72e14be9208d2ba (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 1f44d001620fd3caa30619a9bc73e9d15555408b (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 62efee351566321ad72a4abaf6eb7d972590585d (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < eed73a65ab609b79d53de88cccc34b36dfe753c4 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb7393519908befdc094be4ea913f582adbf2f7c",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "7177c215e69658adbd2f2fc5b72e14be9208d2ba",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "1f44d001620fd3caa30619a9bc73e9d15555408b",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "62efee351566321ad72a4abaf6eb7d972590585d",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "eed73a65ab609b79d53de88cccc34b36dfe753c4",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: unregister debugfs entries on teardown\n\nucsi_register() creates per-instance debugfs entries, but\nucsi_unregister() keeps them around until ucsi_destroy().\n\nDrivers like ucsi_glink that unregister/register the same UCSI\ninstance across remoteproc restart then try to create an already\nexisting debugfs directory and log:\n\n debugfs: \u0027pmic_glink.ucsi.0\u0027 already exists in \u0027ucsi\u0027\n\nUnregister debugfs entries as part of ucsi_unregister(), and\nclear ucsi-\u003edebugfs after freeing it so repeated unregister\npaths remain safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb7393519908befdc094be4ea913f582adbf2f7c"
},
{
"url": "https://git.kernel.org/stable/c/7177c215e69658adbd2f2fc5b72e14be9208d2ba"
},
{
"url": "https://git.kernel.org/stable/c/1f44d001620fd3caa30619a9bc73e9d15555408b"
},
{
"url": "https://git.kernel.org/stable/c/62efee351566321ad72a4abaf6eb7d972590585d"
},
{
"url": "https://git.kernel.org/stable/c/eed73a65ab609b79d53de88cccc34b36dfe753c4"
}
],
"title": "usb: typec: ucsi: unregister debugfs entries on teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100079",
"datePublished": "2026-09-25T13:06:49.915Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100078 (GCVE-0-2026-100078)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
wifi: iwlwifi: mei: pass correct argument to function
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: pass correct argument to function
The first argument to iwl_mei_write_cyclic_buf() should be the cldev
but the q_head pointer is passed instead. Fix it.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
652291601459272d52b6ba12811f0b60b3e6444f , < 034445e19f12bb8771c58e2ecf1fbd6eac9b5fac
(git)
Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < f22ad9d1077c83718d9e6c84b71726287c1d1ad3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < ee91ae7f5815345612d8c0afd5d7efed361bcdb5 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 082b353c05b8eaf07e03fc1918c176cd3c216e25 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 905f57aefde4f4092a411c8a55856182fb1c7598 (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034445e19f12bb8771c58e2ecf1fbd6eac9b5fac",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "f22ad9d1077c83718d9e6c84b71726287c1d1ad3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "ee91ae7f5815345612d8c0afd5d7efed361bcdb5",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "082b353c05b8eaf07e03fc1918c176cd3c216e25",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "905f57aefde4f4092a411c8a55856182fb1c7598",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mei: pass correct argument to function\n\nThe first argument to iwl_mei_write_cyclic_buf() should be the cldev\nbut the q_head pointer is passed instead. Fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034445e19f12bb8771c58e2ecf1fbd6eac9b5fac"
},
{
"url": "https://git.kernel.org/stable/c/f22ad9d1077c83718d9e6c84b71726287c1d1ad3"
},
{
"url": "https://git.kernel.org/stable/c/ee91ae7f5815345612d8c0afd5d7efed361bcdb5"
},
{
"url": "https://git.kernel.org/stable/c/6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3"
},
{
"url": "https://git.kernel.org/stable/c/082b353c05b8eaf07e03fc1918c176cd3c216e25"
},
{
"url": "https://git.kernel.org/stable/c/905f57aefde4f4092a411c8a55856182fb1c7598"
}
],
"title": "wifi: iwlwifi: mei: pass correct argument to function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100078",
"datePublished": "2026-09-25T13:06:49.327Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100077 (GCVE-0-2026-100077)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
drm/msm: Recover HW before retire hung submit
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we
recover the GPU. Retiring the submit triggers BO free and that can
result in GPU pagefaults since the GPU may be actively accessing those
BOs.
To fix this, retire the submits after gpu recovery is complete in
recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < e36284257eeca13768687bf8e52f66f8ea0e8794
(git)
Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < dc64cf9d71428234389b635d142cb5fe07d57eab (git) Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < b303e1d52811de7d1bcf793560754d4df68d4a1c (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e36284257eeca13768687bf8e52f66f8ea0e8794",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "dc64cf9d71428234389b635d142cb5fe07d57eab",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "b303e1d52811de7d1bcf793560754d4df68d4a1c",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794"
},
{
"url": "https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab"
},
{
"url": "https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c"
}
],
"title": "drm/msm: Recover HW before retire hung submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100077",
"datePublished": "2026-09-25T13:06:48.707Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100076 (GCVE-0-2026-100076)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management
xmit_frame together with its xmit_buf from the driver's fixed-size
management-TX pools via alloc_mgtxmitframe(). On the normal path the frame
is handed to dump_mgntframe(), which transfers ownership and eventually
returns both objects to their pools (the frame and, for beacons, the buf
in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion
path).
Several error/edge paths return early after a successful
alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never
transferred and neither object is freed:
- issue_beacon(): beacon larger than 512 bytes
- issue_probersp(): cur_network->ie_length > MAX_IE_SZ
- issue_probersp(): kzalloc() of the SSID scratch buffer fails
- issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP
Because alloc_mgtxmitframe() removes the frame and buf from their free
lists (list_del_init) without placing them on any pending list, an
orphaned pair is on no list and referenced by nobody, so it is only
reclaimed at driver teardown. Repeated hits progressively exhaust the
management-TX pools until alloc_mgtxmitframe() returns NULL and the
interface can no longer send beacons or probe/assoc responses.
Free the frame and buffer on these paths, matching the existing correct
error handling in issue_assocreq().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c9f6a3b9fdd31a0836b681053155b5997c0156e
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < c48e5aa01525577d6b6e782962a5bfb0e1535cb5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 41b8209376dffbd7b0b85c8bc4697d9166ac62ef (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c9f6a3b9fdd31a0836b681053155b5997c0156e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c48e5aa01525577d6b6e782962a5bfb0e1535cb5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "41b8209376dffbd7b0b85c8bc4697d9166ac62ef",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths\n\nissue_beacon(), issue_probersp() and issue_asocrsp() obtain a management\nxmit_frame together with its xmit_buf from the driver\u0027s fixed-size\nmanagement-TX pools via alloc_mgtxmitframe(). On the normal path the frame\nis handed to dump_mgntframe(), which transfers ownership and eventually\nreturns both objects to their pools (the frame and, for beacons, the buf\nin rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion\npath).\n\nSeveral error/edge paths return early after a successful\nalloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never\ntransferred and neither object is freed:\n\n - issue_beacon(): beacon larger than 512 bytes\n - issue_probersp(): cur_network-\u003eie_length \u003e MAX_IE_SZ\n - issue_probersp(): kzalloc() of the SSID scratch buffer fails\n - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP\n\nBecause alloc_mgtxmitframe() removes the frame and buf from their free\nlists (list_del_init) without placing them on any pending list, an\norphaned pair is on no list and referenced by nobody, so it is only\nreclaimed at driver teardown. Repeated hits progressively exhaust the\nmanagement-TX pools until alloc_mgtxmitframe() returns NULL and the\ninterface can no longer send beacons or probe/assoc responses.\n\nFree the frame and buffer on these paths, matching the existing correct\nerror handling in issue_assocreq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.057Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e"
},
{
"url": "https://git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5"
},
{
"url": "https://git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef"
}
],
"title": "staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100076",
"datePublished": "2026-09-25T13:06:48.057Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100075 (GCVE-0-2026-100075)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 14:41
VLAI
EPSS
VEX
Title
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect
descriptor, the unwind path destroys RDMA contexts but leaves stale
n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later
sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()
can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap
allocation before returning an error.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af00051dbc9f467d4840ec709680660a3f8990fa
(git)
Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < 717ab4d0614e9446bf8e2de6229464499e4008d6 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f1f2252da52cdda912da9993f39f58783b01b38f (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < be1478849e1abb1e12dc12e14cdbf800cc6fa99a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af073bd245180393bcb15d33d3990a6bdc32593a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < bd02d644bd19a2795c018635d273d91e45d2bb95 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < b38f98e176050850f41bb6415f3a71400056623e (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:41:03.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
},
{
"url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
},
{
"url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
},
{
"url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
},
{
"url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
},
{
"url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
},
{
"url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
},
{
"url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
}
],
"title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100075",
"datePublished": "2026-09-25T13:06:47.399Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T14:41:03.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100074 (GCVE-0-2026-100074)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
bpf: Mark bpf_refcount field as unique
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf_refcount field as unique
BPF_REFCOUNT is not marked as a unique field, while it should be. Fix
this oversight.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d54730b50bae1f3119bd686d551d66f0fcc387ca , < e42cede6f90177f4f92f80d3de18f628e61d2087
(git)
Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 641f814965d733936ca3618d4d5a12a8fa9be00e (git) Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 61e655391cb19c31f94ecd4354f624c81ce4cf75 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e42cede6f90177f4f92f80d3de18f628e61d2087",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "641f814965d733936ca3618d4d5a12a8fa9be00e",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "61e655391cb19c31f94ecd4354f624c81ce4cf75",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_refcount field as unique\n\nBPF_REFCOUNT is not marked as a unique field, while it should be. Fix\nthis oversight."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.777Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087"
},
{
"url": "https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e"
},
{
"url": "https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75"
}
],
"title": "bpf: Mark bpf_refcount field as unique",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100074",
"datePublished": "2026-09-25T13:06:46.777Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}