Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
29762 vulnerabilities found for linux_kernel by linux
CVE-2026-64298 (GCVE-0-2026-64298)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
POSIX requires write permission to truncate a file, so an open() that
specifies O_TRUNC must be authorized for write access regardless of the
O_ACCMODE access mode.
nfs_open_permission_mask() builds the access mask passed to
nfs_may_open(), which is the local authorization gate for OPENs the
client serves itself from a cached write delegation via the
can_open_delegated() path in nfs4_try_open_cached(). The mask is
derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a
file the caller cannot write requests only MAY_READ and passes the
local check. The OPEN is then satisfied locally and the truncation is
issued to the server as a SETATTR(size=0) over the delegation stateid,
which the server accepts under standard write-delegation semantics.
POSIX requires that this open fail with EACCES.
Include MAY_WRITE in the mask whenever O_TRUNC is set so the local
check matches the access the server would have enforced.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 4817c8974315b666e895b7d1bb83cd3664c323b1
(git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < cb148a2762d644bff1894728e8835a9a4b84f9ea (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 30fdf4df6c3c00efec947e4ddf97f0fdd4473628 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 22c1fd1355ad4ca27aa7f0fa02719122dd92d9de (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < a937e92c1d00534b5c2e3e9f4381b7e988180797 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < e36501b7d4abdcd6d69a7cb901b2f286b7a3d041 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 5140f099ecd8a2f2808b7f7b720ee1bad8468974 (git) |
|
| Linux | Linux |
Affected:
2.6.24
Unaffected: 0 , < 2.6.24 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4817c8974315b666e895b7d1bb83cd3664c323b1",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
},
{
"lessThan": "cb148a2762d644bff1894728e8835a9a4b84f9ea",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
},
{
"lessThan": "30fdf4df6c3c00efec947e4ddf97f0fdd4473628",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
},
{
"lessThan": "22c1fd1355ad4ca27aa7f0fa02719122dd92d9de",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
},
{
"lessThan": "6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
},
{
"lessThan": "a937e92c1d00534b5c2e3e9f4381b7e988180797",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
},
{
"lessThan": "e36501b7d4abdcd6d69a7cb901b2f286b7a3d041",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
},
{
"lessThan": "5140f099ecd8a2f2808b7f7b720ee1bad8468974",
"status": "affected",
"version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached(). The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check. The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An unprivileged local process triggers the flaw through open/openat with O_RDONLY|O_TRUNC on an accessible NFSv4-mounted file. The resulting NFS RPC is outbound and does not make the attack remotely reachable.\nAC:L - Once the client holds a standard cached write delegation, a single deterministic open triggers the unauthorized truncation without a race or timing requirement. Delegations persist and the attacker can repeatedly target files actively written through the same client.\nPR:L - The attacker needs only ordinary local access and read/search permission for the target path; no capability or administrative privilege is required. User namespaces are unnecessary.\nUI:N - The attacker invokes open directly and no contemporaneous action by another user is required.\nS:U - The faulty client-side permission check and modification of the delegated NFS file remain within the NFS filesystem access-control authority.\nC:N - The flaw discloses no kernel or file data beyond content the caller was already authorized to read, and it involves no memory corruption.\nI:H - The attacker can irreversibly truncate the complete contents of a file for which write access was denied, causing total integrity loss of that resource.\nA:H - Truncating critical NFS-hosted executables, configuration, databases, or operational data can completely disable dependent systems or services, and the attack can be repeated against additional delegated files."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:55.989Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1"
},
{
"url": "https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea"
},
{
"url": "https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628"
},
{
"url": "https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de"
},
{
"url": "https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230"
},
{
"url": "https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797"
},
{
"url": "https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041"
},
{
"url": "https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974"
}
],
"title": "NFSv4: include MAY_WRITE in open permission mask for O_TRUNC",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64298",
"datePublished": "2026-07-25T08:49:35.101Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:55.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64297 (GCVE-0-2026-64297)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
module: decompress: check return value of module_extend_max_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved:
module: decompress: check return value of module_extend_max_pages()
module_extend_max_pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.
If the initial allocation fails, info->pages remains NULL and
info->max_pages remains 0. Subsequent calls to module_get_next_page()
will attempt to dynamically grow the array by calling
module_extend_max_pages(info, 0) since info->used_pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated
as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel
oops.
Fix: add the missing error check after module_extend_max_pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.
[Sami: Corrected the analysis in the commit message.]
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7 , < e7f174715f9f0cbcb9e87b52e4fc4ef149baac98
(git)
Affected: b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7 , < afcc0515bbdd28d509a2b5870faaa89b137f5d53 (git) Affected: b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7 , < 168072baf9ad516d5a06046514c7fea4c0671990 (git) Affected: b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7 , < a82e170637e050a803b4f37542371ef216bf66d2 (git) Affected: b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7 , < e7da02659c229f73492fb1ed87ceda4090153aaa (git) Affected: b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7 , < 786d2d84416a9a1c1a47b71a68d679d886284be2 (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/module/decompress.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7f174715f9f0cbcb9e87b52e4fc4ef149baac98",
"status": "affected",
"version": "b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7",
"versionType": "git"
},
{
"lessThan": "afcc0515bbdd28d509a2b5870faaa89b137f5d53",
"status": "affected",
"version": "b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7",
"versionType": "git"
},
{
"lessThan": "168072baf9ad516d5a06046514c7fea4c0671990",
"status": "affected",
"version": "b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7",
"versionType": "git"
},
{
"lessThan": "a82e170637e050a803b4f37542371ef216bf66d2",
"status": "affected",
"version": "b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7",
"versionType": "git"
},
{
"lessThan": "e7da02659c229f73492fb1ed87ceda4090153aaa",
"status": "affected",
"version": "b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7",
"versionType": "git"
},
{
"lessThan": "786d2d84416a9a1c1a47b71a68d679d886284be2",
"status": "affected",
"version": "b1ae6dc41eaaa98bb75671e0f3665bfda248c3e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/module/decompress.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: decompress: check return value of module_extend_max_pages()\n\nmodule_extend_max_pages() calls kvrealloc() internally and returns\n-ENOMEM on allocation failure. The return value is never checked.\n\nIf the initial allocation fails, info-\u003epages remains NULL and\ninfo-\u003emax_pages remains 0. Subsequent calls to module_get_next_page()\nwill attempt to dynamically grow the array by calling\nmodule_extend_max_pages(info, 0) since info-\u003eused_pages is 0. This\nresults in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated\nas a success, leading to a dereference of ZERO_SIZE_PTR and a kernel\noops.\n\nFix: add the missing error check after module_extend_max_pages() and\nreturn immediately on failure. This matches the pattern used by every\nother kvrealloc() caller in the module loading path.\n\n[Sami: Corrected the analysis in the commit message.]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:54.883Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7f174715f9f0cbcb9e87b52e4fc4ef149baac98"
},
{
"url": "https://git.kernel.org/stable/c/afcc0515bbdd28d509a2b5870faaa89b137f5d53"
},
{
"url": "https://git.kernel.org/stable/c/168072baf9ad516d5a06046514c7fea4c0671990"
},
{
"url": "https://git.kernel.org/stable/c/a82e170637e050a803b4f37542371ef216bf66d2"
},
{
"url": "https://git.kernel.org/stable/c/e7da02659c229f73492fb1ed87ceda4090153aaa"
},
{
"url": "https://git.kernel.org/stable/c/786d2d84416a9a1c1a47b71a68d679d886284be2"
}
],
"title": "module: decompress: check return value of module_extend_max_pages()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64297",
"datePublished": "2026-07-25T08:49:34.486Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:54.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64296 (GCVE-0-2026-64296)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
exfat: bound uniname advance in exfat_find_dir_entry()
Summary
In the Linux kernel, the following vulnerability has been resolved:
exfat: bound uniname advance in exfat_find_dir_entry()
In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the
output pointer by a fixed amount while the loop guard only tracks the
accumulated name length:
if (++order == 2)
uniname = p_uniname->name;
else
uniname += EXFAT_FILE_NAME_LEN;
len = exfat_extract_uni_name(ep, entry_uniname);
name_len += len;
unichar = *(uniname+len);
*(uniname+len) = 0x0;
uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len
grows only by the actual extracted length, which is shorter when a name
fragment contains an early NUL. The only guard is
`name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short
name fragments lets uniname run far past the
p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small,
causing an out-of-bounds read and write at *(uniname+len).
The sibling extractor exfat_get_uniname_from_ext_entry() already stops
on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard
added in commit d42334578eba ("exfat: check if filename entries exceeds
max filename length")); exfat_find_dir_entry() never got the
equivalent. Track the per-entry write offset as a count and reject a
fragment once the offset, or the offset plus the extracted length, would
exceed MAX_NAME_LENGTH, before forming the output pointer.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ca06197382bde0a3bc20215595d1c9ce20c6e341 , < 72a2589d82eb001c94b74bcfe6f9a599bd9bef60
(git)
Affected: ca06197382bde0a3bc20215595d1c9ce20c6e341 , < fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4 (git) Affected: ca06197382bde0a3bc20215595d1c9ce20c6e341 , < cf85180b8a015029ee147694eaf4e0b3537e9432 (git) Affected: ca06197382bde0a3bc20215595d1c9ce20c6e341 , < ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0 (git) Affected: ca06197382bde0a3bc20215595d1c9ce20c6e341 , < 727bf7783a2936ffd55c628dddfd69343e511dcf (git) Affected: ca06197382bde0a3bc20215595d1c9ce20c6e341 , < 33c0b96d7e1672be1de0053786637ea46fb81507 (git) Affected: ca06197382bde0a3bc20215595d1c9ce20c6e341 , < c8e041c68c0bbb73aa62371ee63947bb6949d8b2 (git) Affected: ca06197382bde0a3bc20215595d1c9ce20c6e341 , < 3a1230e7b043c62737b05a3e9275ca83a43ad20a (git) |
|
| Linux | Linux |
Affected:
5.7
Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/exfat/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72a2589d82eb001c94b74bcfe6f9a599bd9bef60",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
},
{
"lessThan": "fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
},
{
"lessThan": "cf85180b8a015029ee147694eaf4e0b3537e9432",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
},
{
"lessThan": "ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
},
{
"lessThan": "727bf7783a2936ffd55c628dddfd69343e511dcf",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
},
{
"lessThan": "33c0b96d7e1672be1de0053786637ea46fb81507",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
},
{
"lessThan": "c8e041c68c0bbb73aa62371ee63947bb6949d8b2",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
},
{
"lessThan": "3a1230e7b043c62737b05a3e9275ca83a43ad20a",
"status": "affected",
"version": "ca06197382bde0a3bc20215595d1c9ce20c6e341",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/exfat/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: bound uniname advance in exfat_find_dir_entry()\n\nIn exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the\noutput pointer by a fixed amount while the loop guard only tracks the\naccumulated name length:\n\n\tif (++order == 2)\n\t\tuniname = p_uniname-\u003ename;\n\telse\n\t\tuniname += EXFAT_FILE_NAME_LEN;\n\tlen = exfat_extract_uni_name(ep, entry_uniname);\n\tname_len += len;\n\tunichar = *(uniname+len);\n\t*(uniname+len) = 0x0;\n\nuniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len\ngrows only by the actual extracted length, which is shorter when a name\nfragment contains an early NUL. The only guard is\n`name_len \u003e= MAX_NAME_LENGTH`, so a crafted directory with many short\nname fragments lets uniname run far past the\np_uniname-\u003ename[MAX_NAME_LENGTH + 3] buffer while name_len stays small,\ncausing an out-of-bounds read and write at *(uniname+len).\n\nThe sibling extractor exfat_get_uniname_from_ext_entry() already stops\non a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard\nadded in commit d42334578eba (\"exfat: check if filename entries exceeds\nmax filename length\")); exfat_find_dir_entry() never got the\nequivalent. Track the per-entry write offset as a count and reject a\nfragment once the offset, or the offset plus the extracted length, would\nexceed MAX_NAME_LENGTH, before forming the output pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A crafted exFAT image is reached through local pathname operations such as openat(), which call exfat_lookup(), exfat_find(), and exfat_find_dir_entry(); loop-backed images make physical access unnecessary.\nAC:L - The attacker controls the stream hash, declared name length, extension-entry sequence, and early NUL characters, making the out-of-bounds access deterministic without a race or uncontrollable condition.\nPR:L - Although exFAT cannot be mounted directly from a user namespace, common storage brokers allow an active unprivileged user to mount a loop-backed non-system image. Once mounted, triggering lookup requires only ordinary directory search access and no capability.\nUI:N - The unprivileged attacker can mount the crafted image through such a storage broker and issue the triggering pathname lookup without another user\u0027s action.\nS:U - The vulnerable filesystem parser and the affected kernel memory belong to the same security authority; ordinary kernel privilege escalation does not change scope.\nC:H - Crafted entries cause repeated out-of-bounds 16-bit reads across the kernel stack, and filename comparison behavior can provide an oracle over attacker-selected stack locations. Successful control-flow corruption could disclose arbitrary kernel memory.\nI:H - The function writes zero beyond the stack buffer, and the successful-match path can jump to found without restoring the overwritten value. Attacker-selected stack control data or pointers can therefore be corrupted, potentially enabling arbitrary writes or kernel code execution.\nA:H - Zero-length fragments can advance the pointer until it reaches a stack guard page or corrupts control data, causing an oops, panic, or persistent lockup."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:53.790Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72a2589d82eb001c94b74bcfe6f9a599bd9bef60"
},
{
"url": "https://git.kernel.org/stable/c/fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4"
},
{
"url": "https://git.kernel.org/stable/c/cf85180b8a015029ee147694eaf4e0b3537e9432"
},
{
"url": "https://git.kernel.org/stable/c/ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0"
},
{
"url": "https://git.kernel.org/stable/c/727bf7783a2936ffd55c628dddfd69343e511dcf"
},
{
"url": "https://git.kernel.org/stable/c/33c0b96d7e1672be1de0053786637ea46fb81507"
},
{
"url": "https://git.kernel.org/stable/c/c8e041c68c0bbb73aa62371ee63947bb6949d8b2"
},
{
"url": "https://git.kernel.org/stable/c/3a1230e7b043c62737b05a3e9275ca83a43ad20a"
}
],
"title": "exfat: bound uniname advance in exfat_find_dir_entry()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64296",
"datePublished": "2026-07-25T08:49:33.847Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:53.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64295 (GCVE-0-2026-64295)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
The page_ext iteration API does not validate if the PFN still belongs to a
valid section while advancing the iterator. When dynamically adding
memory in the hotplug path, it can lead to a NULL pointer dereference
during page_ext_lookup at the boundary of the last valid section when
iterator count equals __pgcount.
The for_each_page_ext() macro calls page_ext_iter_next() as its loop
increment. for_each_page_ext() does a "__page_ext =
page_ext_iter_next(&__iter)" at the end. This causes page_ext_iter_next()
to increment iter->index past __pgcount and call page_ext_lookup(start_pfn
+ __pgcount). During memory hotplug (online), the PFN at start_pfn +
__pgcount may belong to a section that has not yet been initialized,
causing page_ext_lookup() to trigger a NULL pointer dereference.
[ 14.555124][ T846] Call trace:
[ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P)
[ 14.555127][ T846] page_ext_lookup+0x30/0x3c
[ 14.555129][ T846] __reset_page_owner+0x11c/0x260
[ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0
[ 14.571204][ T846] __free_pages_core+0x78/0xf0
[ 14.571206][ T846] generic_online_page+0x14/0x24
[ 14.597782][ T846] online_pages+0x178/0x30c
[ 14.597784][ T846] memory_block_change_state+0x284/0x32c
[ 14.597787][ T846] memory_subsys_online+0x4c/0x64
[ 14.597789][ T846] device_online+0x88/0xb0
[ 14.597791][ T846] online_memory_block+0x30/0x40
[ 14.597793][ T846] walk_memory_blocks+0xac/0xe8
[ 14.597794][ T846] add_memory_resource+0x280/0x298
[ 14.656161][ T846] add_memory+0x60/0x98
Move the iteration boundary enforcement inside the iterator functions, so
callers cannot inadvertently access beyond the requested range.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9039b9096ea27a20f0349d1537537663c935c8ed , < 8dcaa0f87a88d720d13106f3a306c6b61d189d86
(git)
Affected: 9039b9096ea27a20f0349d1537537663c935c8ed , < 377b1cd6bbcf327338cd951cc2fd74bc75540235 (git) Affected: 9039b9096ea27a20f0349d1537537663c935c8ed , < ffd017237cfe99e6e5602ab14179b0e6878a0840 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/page_ext.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8dcaa0f87a88d720d13106f3a306c6b61d189d86",
"status": "affected",
"version": "9039b9096ea27a20f0349d1537537663c935c8ed",
"versionType": "git"
},
{
"lessThan": "377b1cd6bbcf327338cd951cc2fd74bc75540235",
"status": "affected",
"version": "9039b9096ea27a20f0349d1537537663c935c8ed",
"versionType": "git"
},
{
"lessThan": "ffd017237cfe99e6e5602ab14179b0e6878a0840",
"status": "affected",
"version": "9039b9096ea27a20f0349d1537537663c935c8ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/page_ext.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access\n\nThe page_ext iteration API does not validate if the PFN still belongs to a\nvalid section while advancing the iterator. When dynamically adding\nmemory in the hotplug path, it can lead to a NULL pointer dereference\nduring page_ext_lookup at the boundary of the last valid section when\niterator count equals __pgcount.\n\nThe for_each_page_ext() macro calls page_ext_iter_next() as its loop\nincrement. for_each_page_ext() does a \"__page_ext =\npage_ext_iter_next(\u0026__iter)\" at the end. This causes page_ext_iter_next()\nto increment iter-\u003eindex past __pgcount and call page_ext_lookup(start_pfn\n+ __pgcount). During memory hotplug (online), the PFN at start_pfn +\n__pgcount may belong to a section that has not yet been initialized,\ncausing page_ext_lookup() to trigger a NULL pointer dereference.\n\n[ 14.555124][ T846] Call trace:\n[ 14.555125][ T846] lookup_page_ext+0x6c/0x108 (P)\n[ 14.555127][ T846] page_ext_lookup+0x30/0x3c\n[ 14.555129][ T846] __reset_page_owner+0x11c/0x260\n[ 14.571201][ T846] __free_pages_ok+0x5e8/0x8e0\n[ 14.571204][ T846] __free_pages_core+0x78/0xf0\n[ 14.571206][ T846] generic_online_page+0x14/0x24\n[ 14.597782][ T846] online_pages+0x178/0x30c\n[ 14.597784][ T846] memory_block_change_state+0x284/0x32c\n[ 14.597787][ T846] memory_subsys_online+0x4c/0x64\n[ 14.597789][ T846] device_online+0x88/0xb0\n[ 14.597791][ T846] online_memory_block+0x30/0x40\n[ 14.597793][ T846] walk_memory_blocks+0xac/0xe8\n[ 14.597794][ T846] add_memory_resource+0x280/0x298\n[ 14.656161][ T846] add_memory+0x60/0x98\n\nMove the iteration boundary enforcement inside the iterator functions, so\ncallers cannot inadvertently access beyond the requested range."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:52.693Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8dcaa0f87a88d720d13106f3a306c6b61d189d86"
},
{
"url": "https://git.kernel.org/stable/c/377b1cd6bbcf327338cd951cc2fd74bc75540235"
},
{
"url": "https://git.kernel.org/stable/c/ffd017237cfe99e6e5602ab14179b0e6878a0840"
}
],
"title": "mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64295",
"datePublished": "2026-07-25T08:49:33.194Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:52.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64294 (GCVE-0-2026-64294)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-23 12:45
VLAI
EPSS
VEX
Title
mm: do file ownership checks with the proper mount idmap
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: do file ownership checks with the proper mount idmap
Ever since idmapped mounts were introduced, inode ownership checks (for
side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done
against the nop_mnt_idmap, which completely ignores the file's mount's
idmap. This results in odd edgecases like:
1) mount/bind-mount with an idmap userA:userB:1
2) userB runs an owner_or_capable() check on file that is owned by userA
on-disk/in-memory, but owned by userB after idmap translation
3) owner_or_capable() mysteriously fails as the correct idmap wasn't supplied
In the case of mincore/madvise MADV_PAGEOUT, this is usually benign,
because file_permission(file, MAY_WRITE) will probably succeed, as it uses
the proper idmap internally, but it does not need to be the case on e.g a
0444 file where even the owner itself doesn't have permissions to write to
it.
Since this is clearly not trivial to get right, introduce a
file_owner_or_capable() that can carry the correct semantics, and switch
the various users in mm to it.
The issue was found by manual code inspection & an off-list discussion
with Jan Kara.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9caccd41541a6f7d6279928d9f971f6642c361af , < 7368bec565bac3e536cd43579dbde1e715e6ba61
(git)
Affected: 9caccd41541a6f7d6279928d9f971f6642c361af , < b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893 (git) Affected: 9caccd41541a6f7d6279928d9f971f6642c361af , < 744b23aa430d52f5c8e4dbff7d71496d6643bed2 (git) Affected: 9caccd41541a6f7d6279928d9f971f6642c361af , < 8344bdf0629457e532797b42d9d2bbf2a2900bbf (git) Affected: 9caccd41541a6f7d6279928d9f971f6642c361af , < 5c942ad7df75925ee166e7f0fb36892d8dde376b (git) Affected: 9caccd41541a6f7d6279928d9f971f6642c361af , < 04ba248d02d9eaa3d9077b00a6134caa75fa3e90 (git) Affected: 9caccd41541a6f7d6279928d9f971f6642c361af , < e187bc02f8fa4226d62814592cf064ee4557c470 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/fs.h",
"mm/filemap.c",
"mm/madvise.c",
"mm/mincore.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7368bec565bac3e536cd43579dbde1e715e6ba61",
"status": "affected",
"version": "9caccd41541a6f7d6279928d9f971f6642c361af",
"versionType": "git"
},
{
"lessThan": "b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893",
"status": "affected",
"version": "9caccd41541a6f7d6279928d9f971f6642c361af",
"versionType": "git"
},
{
"lessThan": "744b23aa430d52f5c8e4dbff7d71496d6643bed2",
"status": "affected",
"version": "9caccd41541a6f7d6279928d9f971f6642c361af",
"versionType": "git"
},
{
"lessThan": "8344bdf0629457e532797b42d9d2bbf2a2900bbf",
"status": "affected",
"version": "9caccd41541a6f7d6279928d9f971f6642c361af",
"versionType": "git"
},
{
"lessThan": "5c942ad7df75925ee166e7f0fb36892d8dde376b",
"status": "affected",
"version": "9caccd41541a6f7d6279928d9f971f6642c361af",
"versionType": "git"
},
{
"lessThan": "04ba248d02d9eaa3d9077b00a6134caa75fa3e90",
"status": "affected",
"version": "9caccd41541a6f7d6279928d9f971f6642c361af",
"versionType": "git"
},
{
"lessThan": "e187bc02f8fa4226d62814592cf064ee4557c470",
"status": "affected",
"version": "9caccd41541a6f7d6279928d9f971f6642c361af",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/fs.h",
"mm/filemap.c",
"mm/madvise.c",
"mm/mincore.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: do file ownership checks with the proper mount idmap\n\nEver since idmapped mounts were introduced, inode ownership checks (for\nside-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done\nagainst the nop_mnt_idmap, which completely ignores the file\u0027s mount\u0027s\nidmap. This results in odd edgecases like:\n\n1) mount/bind-mount with an idmap userA:userB:1\n2) userB runs an owner_or_capable() check on file that is owned by userA\non-disk/in-memory, but owned by userB after idmap translation\n3) owner_or_capable() mysteriously fails as the correct idmap wasn\u0027t supplied\n\nIn the case of mincore/madvise MADV_PAGEOUT, this is usually benign,\nbecause file_permission(file, MAY_WRITE) will probably succeed, as it uses\nthe proper idmap internally, but it does not need to be the case on e.g a\n0444 file where even the owner itself doesn\u0027t have permissions to write to\nit.\n\nSince this is clearly not trivial to get right, introduce a\nfile_owner_or_capable() that can carry the correct semantics, and switch\nthe various users in mm to it.\n\nThe issue was found by manual code inspection \u0026 an off-list discussion\nwith Jan Kara."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:40.258Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7368bec565bac3e536cd43579dbde1e715e6ba61"
},
{
"url": "https://git.kernel.org/stable/c/b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893"
},
{
"url": "https://git.kernel.org/stable/c/744b23aa430d52f5c8e4dbff7d71496d6643bed2"
},
{
"url": "https://git.kernel.org/stable/c/8344bdf0629457e532797b42d9d2bbf2a2900bbf"
},
{
"url": "https://git.kernel.org/stable/c/5c942ad7df75925ee166e7f0fb36892d8dde376b"
},
{
"url": "https://git.kernel.org/stable/c/04ba248d02d9eaa3d9077b00a6134caa75fa3e90"
},
{
"url": "https://git.kernel.org/stable/c/e187bc02f8fa4226d62814592cf064ee4557c470"
}
],
"title": "mm: do file ownership checks with the proper mount idmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64294",
"datePublished": "2026-07-25T08:49:32.570Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-23T12:45:40.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64293 (GCVE-0-2026-64293)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
The bound-check in iommufd_veventq_fops_read() for the normal vEVENT
path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr):
if (!vevent_for_lost_events_header(cur) &&
sizeof(hdr) + cur->data_len > count - done) {
hdr is declared as struct iommufd_vevent_header *, so sizeof(hdr)
evaluates to the size of the pointer. Surrounding code uses
sizeof(*hdr) consistently:
if (done >= count || sizeof(*hdr) > count - done) {
...
if (copy_to_user(buf + done, hdr, sizeof(*hdr))) {
...
done += sizeof(*hdr);
struct iommufd_vevent_header is currently 8 bytes (two __u32 fields,
flags and sequence), so on 64-bit (sizeof(void *) == 8) the two
expressions happen to be equal and the check works as intended.
On 32-bit (sizeof(void *) == 4) the check under-counts the header by
4 bytes: a vEVENT whose data_len causes 8 + cur->data_len to exceed
count - done while 4 + cur->data_len does not will pass the check,
then the loop will copy_to_user 8 bytes of header followed by data_len
bytes of payload, writing past the user-supplied buffer.
It is also a latent bug for any future expansion of struct
iommufd_vevent_header beyond sizeof(void *) on 64-bit; the check
should not depend on the type happening to match the host pointer
width.
Use sizeof(*hdr) to match the rest of the function and the actual
amount that will be copied.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e36ba5ab808ef6237c3148d469c8238674230e2b , < 04a177f91160ee18da98f5689482cf0f589ec869
(git)
Affected: e36ba5ab808ef6237c3148d469c8238674230e2b , < 0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72 (git) Affected: e36ba5ab808ef6237c3148d469c8238674230e2b , < be93d186ae88a92e7aa77e122d4e661fa57b1e39 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/eventq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "04a177f91160ee18da98f5689482cf0f589ec869",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
},
{
"lessThan": "0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
},
{
"lessThan": "be93d186ae88a92e7aa77e122d4e661fa57b1e39",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/eventq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read\n\nThe bound-check in iommufd_veventq_fops_read() for the normal vEVENT\npath uses sizeof(hdr) where the surrounding code uses sizeof(*hdr):\n\n\tif (!vevent_for_lost_events_header(cur) \u0026\u0026\n\t sizeof(hdr) + cur-\u003edata_len \u003e count - done) {\n\nhdr is declared as struct iommufd_vevent_header *, so sizeof(hdr)\nevaluates to the size of the pointer. Surrounding code uses\nsizeof(*hdr) consistently:\n\n\tif (done \u003e= count || sizeof(*hdr) \u003e count - done) {\n\t...\n\tif (copy_to_user(buf + done, hdr, sizeof(*hdr))) {\n\t...\n\tdone += sizeof(*hdr);\n\nstruct iommufd_vevent_header is currently 8 bytes (two __u32 fields,\nflags and sequence), so on 64-bit (sizeof(void *) == 8) the two\nexpressions happen to be equal and the check works as intended.\n\nOn 32-bit (sizeof(void *) == 4) the check under-counts the header by\n4 bytes: a vEVENT whose data_len causes 8 + cur-\u003edata_len to exceed\ncount - done while 4 + cur-\u003edata_len does not will pass the check,\nthen the loop will copy_to_user 8 bytes of header followed by data_len\nbytes of payload, writing past the user-supplied buffer.\n\nIt is also a latent bug for any future expansion of struct\niommufd_vevent_header beyond sizeof(void *) on 64-bit; the check\nshould not depend on the type happening to match the host pointer\nwidth.\n\nUse sizeof(*hdr) to match the rest of the function and the actual\namount that will be copied."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable function is reached through read() on a locally held iommufd vEVENTQ file descriptor; it is not directly network- or device-packet-facing.\nAC:L - On an affected 32-bit deployment, the attacker can deterministically queue an event and choose a count that is one to four bytes too small; no race or uncontrollable condition is required.\nPR:L - No capability check occurs during the vulnerable read, and an unprivileged VMM or user granted an iommufd/vEVENTQ descriptor can invoke it without real init-namespace root.\nUI:N - Exploitation requires only attacker-controlled event generation and a read syscall; no separate victim action is required.\nS:U - The corruption occurs through the host kernel\u0027s userspace API and does not itself bypass an IOMMU boundary or demonstrate a guest-to-host escape.\nC:H - The four-byte overwrite can replace a complete pointer or control word in a 32-bit event consumer, potentially enabling code execution and disclosure of arbitrary process secrets.\nI:H - The kernel writes up to four payload bytes beyond the declared userspace buffer, which can corrupt a full 32-bit control value and potentially permit control-flow hijacking.\nA:H - The overwrite can crash a privileged VMM or other event-consuming service, and controllable event generation permits the condition to be triggered repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:50.497Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/04a177f91160ee18da98f5689482cf0f589ec869"
},
{
"url": "https://git.kernel.org/stable/c/0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72"
},
{
"url": "https://git.kernel.org/stable/c/be93d186ae88a92e7aa77e122d4e661fa57b1e39"
}
],
"title": "iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64293",
"datePublished": "2026-07-25T08:49:31.945Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:50.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64292 (GCVE-0-2026-64292)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
iommufd: Move vevent memory allocation outside spinlock
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Move vevent memory allocation outside spinlock
The veventq memory allocation happens inside the spinlock. Given its depth
is decided by the user space, this leaves a vulnerability, where userspace
can allocate large queues to exhaust atomic memory reserves.
Move the allocation outside the spinlock and use GFP_NOWAIT, which can fail
fast under memory pressure without dipping into the GFP_ATOMIC reserves or
direct-reclaiming from the threaded IRQ handler. On allocation failure,
queue the lost_events_header (so userspace learns of the drop) and return
-ENOMEM so the caller learns of the kernel-side memory pressure.
This is intentionally distinct from the queue-overflow path, which also
queues the lost_events_header but returns 0: a full queue is an expected
userspace-pacing condition rather than a kernel error.
A subsequent change will cap the upper bound of the veventq_depth.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e36ba5ab808ef6237c3148d469c8238674230e2b , < 779480ea79551c31964e74b9aef0e730faa3aa11
(git)
Affected: e36ba5ab808ef6237c3148d469c8238674230e2b , < 6c5fc40200cd0a87d66a368eee00df4d1cca946e (git) Affected: e36ba5ab808ef6237c3148d469c8238674230e2b , < 47443565d10c51366c9382dbc8597cd6c460b8a2 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "779480ea79551c31964e74b9aef0e730faa3aa11",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
},
{
"lessThan": "6c5fc40200cd0a87d66a368eee00df4d1cca946e",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
},
{
"lessThan": "47443565d10c51366c9382dbc8597cd6c460b8a2",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Move vevent memory allocation outside spinlock\n\nThe veventq memory allocation happens inside the spinlock. Given its depth\nis decided by the user space, this leaves a vulnerability, where userspace\ncan allocate large queues to exhaust atomic memory reserves.\n\nMove the allocation outside the spinlock and use GFP_NOWAIT, which can fail\nfast under memory pressure without dipping into the GFP_ATOMIC reserves or\ndirect-reclaiming from the threaded IRQ handler. On allocation failure,\nqueue the lost_events_header (so userspace learns of the drop) and return\n-ENOMEM so the caller learns of the kernel-side memory pressure.\n\nThis is intentionally distinct from the queue-overflow path, which also\nqueues the lost_events_header but returns 0: a full queue is an expected\nuserspace-pacing condition rather than a kernel error.\n\nA subsequent change will cap the upper bound of the veventq_depth."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:49.390Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/779480ea79551c31964e74b9aef0e730faa3aa11"
},
{
"url": "https://git.kernel.org/stable/c/6c5fc40200cd0a87d66a368eee00df4d1cca946e"
},
{
"url": "https://git.kernel.org/stable/c/47443565d10c51366c9382dbc8597cd6c460b8a2"
}
],
"title": "iommufd: Move vevent memory allocation outside spinlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64292",
"datePublished": "2026-07-25T08:49:31.325Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:49.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64291 (GCVE-0-2026-64291)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
iommufd: Set veventq_depth upper bound
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Set veventq_depth upper bound
iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with
an upper bound at U32_MAX.
This leaves a vulnerability where userspace can allocate excessively large
queues to exhaust kernel memory reserves.
Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the
maximum number of entries in the SMMUv3 EVTQ (the largest use case today).
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e36ba5ab808ef6237c3148d469c8238674230e2b , < f565297edf316016be4a1a9e2eb9f39359313f43
(git)
Affected: e36ba5ab808ef6237c3148d469c8238674230e2b , < e7b5e55652746b1221b9c10ff80eae8a154101ba (git) Affected: e36ba5ab808ef6237c3148d469c8238674230e2b , < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/eventq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f565297edf316016be4a1a9e2eb9f39359313f43",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
},
{
"lessThan": "e7b5e55652746b1221b9c10ff80eae8a154101ba",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
},
{
"lessThan": "6ebf2eb46fbd5b40393ff8fbb847ba96925beaff",
"status": "affected",
"version": "e36ba5ab808ef6237c3148d469c8238674230e2b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/eventq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Set veventq_depth upper bound\n\niommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with\nan upper bound at U32_MAX.\n\nThis leaves a vulnerability where userspace can allocate excessively large\nqueues to exhaust kernel memory reserves.\n\nCap the veventq_depth (maximum number of entries) to 1 \u003c\u003c 19, matching the\nmaximum number of entries in the SMMUv3 EVTQ (the largest use case today)."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:48.275Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f565297edf316016be4a1a9e2eb9f39359313f43"
},
{
"url": "https://git.kernel.org/stable/c/e7b5e55652746b1221b9c10ff80eae8a154101ba"
},
{
"url": "https://git.kernel.org/stable/c/6ebf2eb46fbd5b40393ff8fbb847ba96925beaff"
}
],
"title": "iommufd: Set veventq_depth upper bound",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64291",
"datePublished": "2026-07-25T08:49:30.686Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:48.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64290 (GCVE-0-2026-64290)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
iommufd: Break the loop on failure in iommufd_fault_fops_read()
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Break the loop on failure in iommufd_fault_fops_read()
On a copy_to_user() failure inside the inner list_for_each_entry, only the
inner loop breaks; the outer while re-fetches the just-restored fault group
and retries the failing copy_to_user() forever, spinning the reader at 100%
CPU with fault->mutex held.
Check rc after the inner loop and break the outer while as well.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < a38e0714affc5c0bbb40cba5a65d6d32a5e72a71
(git)
Affected: 07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < 5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8 (git) Affected: 07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < f66c16b175509642ee7082df57c9bf3deaebae1a (git) Affected: 07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < 172fc8b19825a0f5884c38f2289188284e2d45ee (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/eventq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a38e0714affc5c0bbb40cba5a65d6d32a5e72a71",
"status": "affected",
"version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
"versionType": "git"
},
{
"lessThan": "5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8",
"status": "affected",
"version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
"versionType": "git"
},
{
"lessThan": "f66c16b175509642ee7082df57c9bf3deaebae1a",
"status": "affected",
"version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
"versionType": "git"
},
{
"lessThan": "172fc8b19825a0f5884c38f2289188284e2d45ee",
"status": "affected",
"version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/eventq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Break the loop on failure in iommufd_fault_fops_read()\n\nOn a copy_to_user() failure inside the inner list_for_each_entry, only the\ninner loop breaks; the outer while re-fetches the just-restored fault group\nand retries the failing copy_to_user() forever, spinning the reader at 100%\nCPU with fault-\u003emutex held.\n\nCheck rc after the inner loop and break the outer while as well."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:47.176Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a38e0714affc5c0bbb40cba5a65d6d32a5e72a71"
},
{
"url": "https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8"
},
{
"url": "https://git.kernel.org/stable/c/f66c16b175509642ee7082df57c9bf3deaebae1a"
},
{
"url": "https://git.kernel.org/stable/c/172fc8b19825a0f5884c38f2289188284e2d45ee"
}
],
"title": "iommufd: Break the loop on failure in iommufd_fault_fops_read()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64290",
"datePublished": "2026-07-25T08:49:30.049Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:47.176Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64289 (GCVE-0-2026-64289)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
iommufd: Set upper bounds on cache invalidation entry_num and entry_len
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Set upper bounds on cache invalidation entry_num and entry_len
iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len,
each bounded only by U32_MAX. An entry_len beyond the kernel's struct size
makes the copy helper verify the extra bytes are zero, scanning that excess
in one uninterruptible pass; a multi-gigabyte value over zeroed user memory
trips the soft-lockup watchdog.
A large entry_num is the other half, driving the backend invalidation loop
with no reschedule. The VT-d nested handler, for one, copies each entry and
flushes caches per iteration, pinning the CPU on a non-preemptible kernel.
Cap both in the ioctl. entry_len is held under PAGE_SIZE, above any request
struct, and entry_num under 1 << 19, the order of a hardware invalidation
queue and well beyond any real batch, bounding the per-call loop length.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8c6eabae3807e048b9f17733af5e20500fbf858c , < d2bd041e0efaf7d81789779b135279d18b33d6d5
(git)
Affected: 8c6eabae3807e048b9f17733af5e20500fbf858c , < 32ca4aed2a66205b072fcfecabe220289a8149ff (git) Affected: 8c6eabae3807e048b9f17733af5e20500fbf858c , < 2c6381d90898089287e0a358f06f89f6b4b389f2 (git) Affected: 8c6eabae3807e048b9f17733af5e20500fbf858c , < 4d70986002f2f3eaaed89124fb2522bded38b016 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/hw_pagetable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d2bd041e0efaf7d81789779b135279d18b33d6d5",
"status": "affected",
"version": "8c6eabae3807e048b9f17733af5e20500fbf858c",
"versionType": "git"
},
{
"lessThan": "32ca4aed2a66205b072fcfecabe220289a8149ff",
"status": "affected",
"version": "8c6eabae3807e048b9f17733af5e20500fbf858c",
"versionType": "git"
},
{
"lessThan": "2c6381d90898089287e0a358f06f89f6b4b389f2",
"status": "affected",
"version": "8c6eabae3807e048b9f17733af5e20500fbf858c",
"versionType": "git"
},
{
"lessThan": "4d70986002f2f3eaaed89124fb2522bded38b016",
"status": "affected",
"version": "8c6eabae3807e048b9f17733af5e20500fbf858c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/hw_pagetable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Set upper bounds on cache invalidation entry_num and entry_len\n\niommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len,\neach bounded only by U32_MAX. An entry_len beyond the kernel\u0027s struct size\nmakes the copy helper verify the extra bytes are zero, scanning that excess\nin one uninterruptible pass; a multi-gigabyte value over zeroed user memory\ntrips the soft-lockup watchdog.\n\nA large entry_num is the other half, driving the backend invalidation loop\nwith no reschedule. The VT-d nested handler, for one, copies each entry and\nflushes caches per iteration, pinning the CPU on a non-preemptible kernel.\n\nCap both in the ioctl. entry_len is held under PAGE_SIZE, above any request\nstruct, and entry_num under 1 \u003c\u003c 19, the order of a hardware invalidation\nqueue and well beyond any real batch, bounding the per-call loop length."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:45.289Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d2bd041e0efaf7d81789779b135279d18b33d6d5"
},
{
"url": "https://git.kernel.org/stable/c/32ca4aed2a66205b072fcfecabe220289a8149ff"
},
{
"url": "https://git.kernel.org/stable/c/2c6381d90898089287e0a358f06f89f6b4b389f2"
},
{
"url": "https://git.kernel.org/stable/c/4d70986002f2f3eaaed89124fb2522bded38b016"
}
],
"title": "iommufd: Set upper bounds on cache invalidation entry_num and entry_len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64289",
"datePublished": "2026-07-25T08:49:29.434Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:45.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64288 (GCVE-0-2026-64288)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions,
and either can race against a vcpu not being onlined yet (no pseudo-TLB
allocated). Similarly, the TLB might be invalid, and the invalidation
should be skipped in this case.
Both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are
expected to perform the same checks, except that the latter doesn't
check for the allocation and blindly dereferences the pointer.
Solve this by introducing a new iterator built on top of the usual
kvm_for_each_vcpu() that checks for both of the above conditions,
and convert the two users to it.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 , < 7c73a269a880b1399baacfb9d521415e6ef7ecc2
(git)
Affected: 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 , < 5fd30133af864a1de0a0bd87d3fe3cf23205fbc7 (git) Affected: 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 , < 4be6cbeb93d26994bd1827ddbce391e3c4395c8f (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c73a269a880b1399baacfb9d521415e6ef7ecc2",
"status": "affected",
"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
"versionType": "git"
},
{
"lessThan": "5fd30133af864a1de0a0bd87d3fe3cf23205fbc7",
"status": "affected",
"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
"versionType": "git"
},
{
"lessThan": "4be6cbeb93d26994bd1827ddbce391e3c4395c8f",
"status": "affected",
"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB\n\nVNCR TLB invalidation occurs from MMU notifiers or TLBI instructions,\nand either can race against a vcpu not being onlined yet (no pseudo-TLB\nallocated). Similarly, the TLB might be invalid, and the invalidation\nshould be skipped in this case.\n\nBoth kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are\nexpected to perform the same checks, except that the latter doesn\u0027t\ncheck for the allocation and blindly dereferences the pointer.\n\nSolve this by introducing a new iterator built on top of the usual\nkvm_for_each_vcpu() that checks for both of the above conditions,\nand convert the two users to it."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:44.195Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c73a269a880b1399baacfb9d521415e6ef7ecc2"
},
{
"url": "https://git.kernel.org/stable/c/5fd30133af864a1de0a0bd87d3fe3cf23205fbc7"
},
{
"url": "https://git.kernel.org/stable/c/4be6cbeb93d26994bd1827ddbce391e3c4395c8f"
}
],
"title": "KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64288",
"datePublished": "2026-07-25T08:49:28.789Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:44.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64287 (GCVE-0-2026-64287)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU
on every run. The vGIC list register save and restore use used_lrs as
their loop bound and expect it to stay within the number of implemented
list registers. While this is generally the case, flush_hyp_vcpu()
copies vgic_v3 verbatim and does not enforce this, so a value provided
by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2
(host -> EL2).
Fix by clamping used_lrs to the number of implemented list registers
after the copy, as the trusted path already does in
vgic_flush_lr_state(). The number of implemented list registers is
constant after init, so it is replicated once from
kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on
every entry.
Severity
8.2 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
be66e67f175096f283c9d5614c4991fc9e7ed975 , < 2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8
(git)
Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 9fa301d8298778dd799fa4dcf7a7f440715d146e (git) Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < c646431865f4b1a5b14067233fa27b11e05e0d46 (git) Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 7fca3fcef81c713bc82a37bf741e0f28e6d04a6f (git) Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 8cc8bbbfab14c22c5551d0dd19b208a44b141c76 (git) |
|
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/kvm_hyp.h",
"arch/arm64/kvm/arm.c",
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "9fa301d8298778dd799fa4dcf7a7f440715d146e",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "c646431865f4b1a5b14067233fa27b11e05e0d46",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "7fca3fcef81c713bc82a37bf741e0f28e6d04a6f",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "8cc8bbbfab14c22c5551d0dd19b208a44b141c76",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/kvm_hyp.h",
"arch/arm64/kvm/arm.c",
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp\u0027s private vCPU\non every run. The vGIC list register save and restore use used_lrs as\ntheir loop bound and expect it to stay within the number of implemented\nlist registers. While this is generally the case, flush_hyp_vcpu()\ncopies vgic_v3 verbatim and does not enforce this, so a value provided\nby the host is used at EL2 to index vgic_lr[] and access ICH_LR\u003cn\u003e_EL2\n(host -\u003e EL2).\n\nFix by clamping used_lrs to the number of implemented list registers\nafter the copy, as the trusted path already does in\nvgic_flush_lr_state(). The number of implemented list registers is\nconstant after init, so it is replicated once from\nkvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on\nevery entry."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A malicious or compromised arm64 EL1 host reaches the flaw through the local KVM vCPU-run hypercall into pKVM EL2. No network or adjacent protocol directly controls this internal field.\nAC:L - On a pKVM/GICv3 system, the host can directly select an oversized used_lrs value and deterministically trigger the unchecked loops. No race or condition outside the attacker\u0027s control is required.\nPR:H - Normal KVM paths keep used_lrs hardware-bounded, and neither an unprivileged KVM user nor a user namespace can assign it directly. Exploitation requires control of the host kernel at EL1, equivalent to real administrative privileges.\nUI:N - The malicious host can load and run a vCPU itself without any action by a protected-VM user or another victim.\nS:C - Exploitation crosses pKVM\u0027s EL1-host-to-EL2 isolation boundary and can affect hypervisor-private state and protected VMs outside the host\u0027s security authority.\nC:H - The restore and synchronization paths can read beyond vgic_lr[] and transfer hyp-private vCPU data back into host-visible memory. EL2 compromise could expose protected-VM memory and other hypervisor secrets.\nI:H - The save path writes beyond vgic_lr[] into adjacent hyp-private vCPU metadata, including pointer, lock, and list state. This memory corruption is plausibly usable for EL2 control-flow hijacking and protected-VM modification.\nA:H - Large bounds can cause extensive loops, invalid EL2 memory accesses, or corruption of critical hypervisor metadata. An nVHE hypervisor panic explicitly escalates to a host kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:43.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8"
},
{
"url": "https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e"
},
{
"url": "https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46"
},
{
"url": "https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f"
},
{
"url": "https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76"
}
],
"title": "KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64287",
"datePublished": "2026-07-25T08:49:28.168Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:43.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64286 (GCVE-0-2026-64286)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vCPU context into the hyp's private
vCPU on every run. ctxt_to_vcpu() expects a guest context to have a
NULL __hyp_running_vcpu, which is only ever set on the host context, so
that it resolves the vCPU via container_of(). While this is generally
the case, flush_hyp_vcpu() copies the context verbatim and does not
enforce this, so a value provided by the host is dereferenced at EL2
(host -> EL2).
Fix by clearing __hyp_running_vcpu after the copy.
Severity
8.2 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
be66e67f175096f283c9d5614c4991fc9e7ed975 , < 477145860dba4c30f0b4e36f02f4c5291c1c888b
(git)
Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < dfaef40d8a1533940fc1af788d70fce07362b4ce (git) Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < 6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa (git) Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < d4f4d61715d1061ba83b88196a3605662be30750 (git) Affected: be66e67f175096f283c9d5614c4991fc9e7ed975 , < e8042f6e1d7befb2fb6b10a75918642bcd0acf9a (git) |
|
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "477145860dba4c30f0b4e36f02f4c5291c1c888b",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "dfaef40d8a1533940fc1af788d70fce07362b4ce",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "d4f4d61715d1061ba83b88196a3605662be30750",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "e8042f6e1d7befb2fb6b10a75918642bcd0acf9a",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vCPU context into the hyp\u0027s private\nvCPU on every run. ctxt_to_vcpu() expects a guest context to have a\nNULL __hyp_running_vcpu, which is only ever set on the host context, so\nthat it resolves the vCPU via container_of(). While this is generally\nthe case, flush_hyp_vcpu() copies the context verbatim and does not\nenforce this, so a value provided by the host is dereferenced at EL2\n(host -\u003e EL2).\n\nFix by clearing __hyp_running_vcpu after the copy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A malicious or compromised local EL1 host can place the pointer in the host vCPU context and trigger the vulnerable pKVM path through KVM_RUN; no remote input path reaches it.\nAC:L - The attacker-selected pointer is copied and dereferenced deterministically on every vCPU run, without a race, and EL2 addresses of host-donated metadata are derivable by the host.\nPR:H - Exploitation requires host-kernel control or an equivalent arbitrary kernel write. The KVM userspace register API does not expose __hyp_running_vcpu, and user namespaces do not bypass this restriction.\nUI:N - Once the malicious host context is prepared, invoking the vCPU run path requires no action by another user.\nS:C - The vulnerability crosses the intended isolation boundary from the untrusted EL1 host into the pKVM hypervisor at EL2 and can affect protected-VM resources.\nC:H - The forged pointer drives EL2-private memory dereferences during system-register restoration. Chaining these reads with the write-side corruption can compromise EL2 and expose hypervisor or protected-guest memory.\nI:H - The system-register save path can write through the attacker-selected vCPU pointer into EL2-accessible memory. This can corrupt trusted hypervisor metadata and plausibly enable control-flow or protected-guest state modification.\nA:H - An invalid or unmapped pointer causes a synchronous EL2 fault followed by the nVHE HYP panic handler, which explicitly panics the host kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:42.012Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/477145860dba4c30f0b4e36f02f4c5291c1c888b"
},
{
"url": "https://git.kernel.org/stable/c/dfaef40d8a1533940fc1af788d70fce07362b4ce"
},
{
"url": "https://git.kernel.org/stable/c/6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa"
},
{
"url": "https://git.kernel.org/stable/c/d4f4d61715d1061ba83b88196a3605662be30750"
},
{
"url": "https://git.kernel.org/stable/c/e8042f6e1d7befb2fb6b10a75918642bcd0acf9a"
}
],
"title": "KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64286",
"datePublished": "2026-07-25T08:49:27.542Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:42.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64285 (GCVE-0-2026-64285)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
When populating a guest_memfd instance with the initial CPUID data for an
SNP guest, acquire a writable pin on the source page as KVM will write back
the "correct" CPUID information if the userspace provided data is rejected
by trusted firmware. Because KVM writes to the source page using a kernel
mapping, pinning for read could result in KVM clobbering read-only memory.
Note, well-behaved VMMs are unlikely to be affected, as CPUID information
is almost always dynamically generated by userspace, i.e. it's unlikely for
the CPUID information to be backed by a read-only mapping.
[sean: rewrite shortlog and changelog, tag for stable@]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2a62345b30529e488beb6a1220577b3495933724 , < dcdb476f5fc5701ec06c23efe3e3529f07ca391e
(git)
Affected: 2a62345b30529e488beb6a1220577b3495933724 , < f13e900599089b10113ceb36013423f0837c6792 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c",
"arch/x86/kvm/vmx/tdx.c",
"include/linux/kvm_host.h",
"virt/kvm/guest_memfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dcdb476f5fc5701ec06c23efe3e3529f07ca391e",
"status": "affected",
"version": "2a62345b30529e488beb6a1220577b3495933724",
"versionType": "git"
},
{
"lessThan": "f13e900599089b10113ceb36013423f0837c6792",
"status": "affected",
"version": "2a62345b30529e488beb6a1220577b3495933724",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c",
"arch/x86/kvm/vmx/tdx.c",
"include/linux/kvm_host.h",
"virt/kvm/guest_memfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Pin source page for write when adding CPUID data for SNP guest\n\nWhen populating a guest_memfd instance with the initial CPUID data for an\nSNP guest, acquire a writable pin on the source page as KVM will write back\nthe \"correct\" CPUID information if the userspace provided data is rejected\nby trusted firmware. Because KVM writes to the source page using a kernel\nmapping, pinning for read could result in KVM clobbering read-only memory.\n\nNote, well-behaved VMMs are unlikely to be affected, as CPUID information\nis almost always dynamically generated by userspace, i.e. it\u0027s unlikely for\nthe CPUID information to be backed by a read-only mapping.\n\n[sean: rewrite shortlog and changelog, tag for stable@]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:40.907Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e"
},
{
"url": "https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792"
}
],
"title": "KVM: SEV: Pin source page for write when adding CPUID data for SNP guest",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64285",
"datePublished": "2026-07-25T08:49:26.898Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-08-17T04:52:40.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64284 (GCVE-0-2026-64284)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
Move the handling of fastpath userspace exits into vendor code to ensure
KVM runs vendor specific operations that need to run before userspace gains
control of the vCPU. E.g. for VMX (and soon to be for SVM as well), KVM
needs to flush the PML buffer prior to exiting to userspace, otherwise any
memory written by the final KVM_RUN might never be flagged as dirty.
Note, waiting to snapshot CR0 and CR3 until svm_handle_exit() is flawed in
general, as that risks consuming stale state in a fastpath handler. That
will be addressed in a future change.
Severity
7.1 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f7f39c50edb9d336274371953275e0d3503b9b75 , < b3436d9b9b1affe1c3191ac9831308923f5f03c3
(git)
Affected: f7f39c50edb9d336274371953275e0d3503b9b75 , < 4ad73ef0e7966ecfe67de0060537b4cb14d9acd4 (git) Affected: f7f39c50edb9d336274371953275e0d3503b9b75 , < f2ca2b5326211bd38490f0497eb583721ce0bbc0 (git) Affected: f7f39c50edb9d336274371953275e0d3503b9b75 , < 0ffedf43910e44b76c2c1db4e9fbf12b268190c1 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/vmx/vmx.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3436d9b9b1affe1c3191ac9831308923f5f03c3",
"status": "affected",
"version": "f7f39c50edb9d336274371953275e0d3503b9b75",
"versionType": "git"
},
{
"lessThan": "4ad73ef0e7966ecfe67de0060537b4cb14d9acd4",
"status": "affected",
"version": "f7f39c50edb9d336274371953275e0d3503b9b75",
"versionType": "git"
},
{
"lessThan": "f2ca2b5326211bd38490f0497eb583721ce0bbc0",
"status": "affected",
"version": "f7f39c50edb9d336274371953275e0d3503b9b75",
"versionType": "git"
},
{
"lessThan": "0ffedf43910e44b76c2c1db4e9fbf12b268190c1",
"status": "affected",
"version": "f7f39c50edb9d336274371953275e0d3503b9b75",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/vmx/vmx.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ensure vendor\u0027s exit handler runs before fastpath userspace exits\n\nMove the handling of fastpath userspace exits into vendor code to ensure\nKVM runs vendor specific operations that need to run before userspace gains\ncontrol of the vCPU. E.g. for VMX (and soon to be for SVM as well), KVM\nneeds to flush the PML buffer prior to exiting to userspace, otherwise any\nmemory written by the final KVM_RUN might never be flagged as dirty.\n\nNote, waiting to snapshot CR0 and CR3 until svm_handle_exit() is flawed in\ngeneral, as that risks consuming stale state in a fastpath handler. That\nwill be addressed in a future change."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through guest execution under the local KVM_RUN ioctl, not through network input.\nAC:L - With PML dirty logging active, the attacker can control guest writes and repeatedly force fastpath userspace exits such as HLT; no uncontrollable race must be won.\nPR:L - KVM_RUN and guest-debug operations require access to the VM\u0027s vCPU file descriptor but perform no capability or init-namespace root check.\nUI:N - No human interaction is required because migration and snapshot processing can be automated while guest code supplies the triggering exits.\nS:U - The flaw corrupts the affected VM\u0027s migration or saved state but does not provide host privilege escalation, host-memory access, or a guest-to-host escape.\nC:N - The incomplete dirty log does not expose memory contents or give the attacker a read primitive.\nI:H - Attacker-selected guest writes can be omitted from the final dirty bitmap, causing arbitrary guest pages to be restored with stale contents and substantially corrupting migrated state.\nA:H - Stale CR state or corrupted guest memory can make a migrated or restored VM crash, hang, or fail to resume."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:39.824Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3436d9b9b1affe1c3191ac9831308923f5f03c3"
},
{
"url": "https://git.kernel.org/stable/c/4ad73ef0e7966ecfe67de0060537b4cb14d9acd4"
},
{
"url": "https://git.kernel.org/stable/c/f2ca2b5326211bd38490f0497eb583721ce0bbc0"
},
{
"url": "https://git.kernel.org/stable/c/0ffedf43910e44b76c2c1db4e9fbf12b268190c1"
}
],
"title": "KVM: x86: Ensure vendor\u0027s exit handler runs before fastpath userspace exits",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64284",
"datePublished": "2026-07-25T08:49:26.270Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-08-17T04:52:39.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64283 (GCVE-0-2026-64283)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
When binding a memslot to a guest_memfd file, treat the offset and size as
unsigned values to fix a bug where the sum of the two can result in a false
negative when checking for overflow against the size of the file. Passing
unsigned values also avoids relying on somewhat obscure checks in other
flows for safety, and tracks the offset and size as they are intended to be
tracked, as unsigned values.
On 64-bit kernels, the number of pages a memslot contains and thus the size
(and offset) of its guest_memfd binding are unsigned 64-bit values. Taking
the offset+size as an loff_t instead of a uoff_t inadvertently converts
the unsigned value to a signed value if the offset and/or size is massive.
Locally storing the offset and size as signed values is benign in and of
itself (though even that is *extremely* difficult to discern), but
operating on their sum is not.
For the offset, KVM explicitly checks against a negative value, which might
seem like a bug as KVM could incorrectly reject a legitimate binding, but
that's not actually the case as KVM_CREATE_GUEST_MEMFD takes a signed value
for its size, i.e. a would-be-negative offset is also greater than the
maximum possible size of any guest_memfd file.
Regarding the size, while KVM lacks an explicit check for a negative value,
i.e. seemingly has a flawed overflow check, KVM restricts the number of
pages in a single memslot to the largest positive signed 32-bit value:
if (id < KVM_USER_MEM_SLOTS &&
(mem->memory_size >> PAGE_SHIFT) > KVM_MEM_MAX_NR_PAGES)
return -EINVAL;
and so that maximum "size" will ever be is 0x7fffffff000.
The sum of the two is, however, problematic. While the size is restricted
by KVM's memslot logic, the offset is not, i.e. the offset is completely
unchecked until the "offset + size > i_size_read(inode)" check. If the
offset is the (nearly) largest possible _positive_ value, then adding size
to the offset can result in a signed, negative 64-bit value. When compared
against the size of the file (guaranteed to be positive), the negative sum
is always smaller, and KVM incorrectly allows the absurd offset.
Opportunistically add missing includes in kvm_mm.h (instead of relying on
its parents).
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a7800aa80ea4d5356b8474c2302812e9d4926fa6 , < f3a98d5881b9bd4807f49156143565f6aabcef1e
(git)
Affected: a7800aa80ea4d5356b8474c2302812e9d4926fa6 , < eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"virt/kvm/guest_memfd.c",
"virt/kvm/kvm_mm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3a98d5881b9bd4807f49156143565f6aabcef1e",
"status": "affected",
"version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
"versionType": "git"
},
{
"lessThan": "eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6",
"status": "affected",
"version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"virt/kvm/guest_memfd.c",
"virt/kvm/kvm_mm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: guest_memfd: Treat memslot binding offset+size as unsigned values\n\nWhen binding a memslot to a guest_memfd file, treat the offset and size as\nunsigned values to fix a bug where the sum of the two can result in a false\nnegative when checking for overflow against the size of the file. Passing\nunsigned values also avoids relying on somewhat obscure checks in other\nflows for safety, and tracks the offset and size as they are intended to be\ntracked, as unsigned values.\n\nOn 64-bit kernels, the number of pages a memslot contains and thus the size\n(and offset) of its guest_memfd binding are unsigned 64-bit values. Taking\nthe offset+size as an loff_t instead of a uoff_t inadvertently converts\nthe unsigned value to a signed value if the offset and/or size is massive.\n\nLocally storing the offset and size as signed values is benign in and of\nitself (though even that is *extremely* difficult to discern), but\noperating on their sum is not.\n\nFor the offset, KVM explicitly checks against a negative value, which might\nseem like a bug as KVM could incorrectly reject a legitimate binding, but\nthat\u0027s not actually the case as KVM_CREATE_GUEST_MEMFD takes a signed value\nfor its size, i.e. a would-be-negative offset is also greater than the\nmaximum possible size of any guest_memfd file.\n\nRegarding the size, while KVM lacks an explicit check for a negative value,\ni.e. seemingly has a flawed overflow check, KVM restricts the number of\npages in a single memslot to the largest positive signed 32-bit value:\n\n if (id \u003c KVM_USER_MEM_SLOTS \u0026\u0026\n (mem-\u003ememory_size \u003e\u003e PAGE_SHIFT) \u003e KVM_MEM_MAX_NR_PAGES)\n return -EINVAL;\n\nand so that maximum \"size\" will ever be is 0x7fffffff000.\n\nThe sum of the two is, however, problematic. While the size is restricted\nby KVM\u0027s memslot logic, the offset is not, i.e. the offset is completely\nunchecked until the \"offset + size \u003e i_size_read(inode)\" check. If the\noffset is the (nearly) largest possible _positive_ value, then adding size\nto the offset can result in a signed, negative 64-bit value. When compared\nagainst the size of the file (guaranteed to be positive), the negative sum\nis always smaller, and KVM incorrectly allows the absurd offset.\n\nOpportunistically add missing includes in kvm_mm.h (instead of relying on\nits parents)."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:38.733Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3a98d5881b9bd4807f49156143565f6aabcef1e"
},
{
"url": "https://git.kernel.org/stable/c/eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6"
}
],
"title": "KVM: guest_memfd: Treat memslot binding offset+size as unsigned values",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64283",
"datePublished": "2026-07-25T08:49:25.642Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-08-17T04:52:38.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64282 (GCVE-0-2026-64282)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
In the case that kvm_translate_vncr() races with an MMU notifier the
early return does not release a reference on the faulted in PFN. Add
the necessary call to kvm_release_faultin_page() for the unused PFN.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
069a05e53549685d2b5e54ceb51db1fd04aa50d7 , < 0c93681aea0a1b8be14730a88abe77c840272e41
(git)
Affected: 069a05e53549685d2b5e54ceb51db1fd04aa50d7 , < cd1067ccc0dbc18890a74db116d00a4bc3c7f2f7 (git) Affected: 069a05e53549685d2b5e54ceb51db1fd04aa50d7 , < 9f76b039a72d7e06374aa96862f0232ed53f7787 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c93681aea0a1b8be14730a88abe77c840272e41",
"status": "affected",
"version": "069a05e53549685d2b5e54ceb51db1fd04aa50d7",
"versionType": "git"
},
{
"lessThan": "cd1067ccc0dbc18890a74db116d00a4bc3c7f2f7",
"status": "affected",
"version": "069a05e53549685d2b5e54ceb51db1fd04aa50d7",
"versionType": "git"
},
{
"lessThan": "9f76b039a72d7e06374aa96862f0232ed53f7787",
"status": "affected",
"version": "069a05e53549685d2b5e54ceb51db1fd04aa50d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Don\u0027t leak PFN when kvm_translate_vncr() races MMU notifier\n\nIn the case that kvm_translate_vncr() races with an MMU notifier the\nearly return does not release a reference on the faulted in PFN. Add\nthe necessary call to kvm_release_faultin_page() for the unused PFN."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:37.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c93681aea0a1b8be14730a88abe77c840272e41"
},
{
"url": "https://git.kernel.org/stable/c/cd1067ccc0dbc18890a74db116d00a4bc3c7f2f7"
},
{
"url": "https://git.kernel.org/stable/c/9f76b039a72d7e06374aa96862f0232ed53f7787"
}
],
"title": "KVM: arm64: Don\u0027t leak PFN when kvm_translate_vncr() races MMU notifier",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64282",
"datePublished": "2026-07-25T08:49:25.011Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-08-17T04:52:37.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64281 (GCVE-0-2026-64281)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
svcrdma: wake sq waiters when the transport closes
Summary
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: wake sq waiters when the transport closes
Threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or
sc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state
across transport teardown, pinning svc_xprt references and
blocking svc_rdma_free().
The close path sets XPT_CLOSE before invoking xpo_detach and both
wait_event predicates include an XPT_CLOSE term, but the
predicates are re-evaluated only on wakeup. sc_sq_ticket_wait has
no completion-driven wake path; it is advanced solely by the
chained ticket handoff inside svc_rdma_sq_wait() itself. Without
an explicit wake at close, parked threads never observe
XPT_CLOSE, hold their svc_xprt_get reference forever, and
svc_rdma_free() blocks on xpt_ref dropping to zero.
Two close entry points reach this transport. Local teardown runs
svc_rdma_detach() from svc_handle_xprt() -> svc_delete_xprt() ->
xpo_detach() on a worker thread. A remote disconnect arrives at
svc_rdma_cma_handler(), which calls svc_xprt_deferred_close():
that sets XPT_CLOSE and enqueues the transport but does not
access either RDMA waitqueue, so a worker already parked in
svc_rdma_sq_wait() never re-evaluates its predicate. With every
worker parked on this transport, no thread is available to run
the local teardown either, and the wake site there is
unreachable.
Introduce svc_rdma_xprt_deferred_close(), a thin svcrdma wrapper
that calls svc_xprt_deferred_close() and then wakes both
sc_sq_ticket_wait and sc_send_wait. Convert the svcrdma producers
that called svc_xprt_deferred_close() directly:
svc_rdma_cma_handler(), qp_event_handler(),
svc_rdma_post_send_err(), svc_rdma_wc_send(), the sendto drop
path, the rw completion error paths, and the recvfrom flush and
read-list error paths.
Wake both waitqueues from svc_rdma_detach() as well. The
synchronous svc_xprt_close() path (backchannel ENOTCONN, device
removal via svc_rdma_xprt_done) reaches detach without flowing
through svc_xprt_deferred_close() and therefore does not invoke
the new helper.
[ cel: add svc_rdma_xprt_deferred_close() to complete the fix ]
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ccc89b9d1ed233349cfe8d87b842e7351b74d8de , < 40eedc4253dbda0b29b7961200534dfcecb48ace
(git)
Affected: ccc89b9d1ed233349cfe8d87b842e7351b74d8de , < e5248a7426030db1e126363f72afdb3b71339a5c (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/sunrpc/svc_rdma.h",
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c",
"net/sunrpc/xprtrdma/svc_rdma_rw.c",
"net/sunrpc/xprtrdma/svc_rdma_sendto.c",
"net/sunrpc/xprtrdma/svc_rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40eedc4253dbda0b29b7961200534dfcecb48ace",
"status": "affected",
"version": "ccc89b9d1ed233349cfe8d87b842e7351b74d8de",
"versionType": "git"
},
{
"lessThan": "e5248a7426030db1e126363f72afdb3b71339a5c",
"status": "affected",
"version": "ccc89b9d1ed233349cfe8d87b842e7351b74d8de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/sunrpc/svc_rdma.h",
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c",
"net/sunrpc/xprtrdma/svc_rdma_rw.c",
"net/sunrpc/xprtrdma/svc_rdma_sendto.c",
"net/sunrpc/xprtrdma/svc_rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: wake sq waiters when the transport closes\n\nThreads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or\nsc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state\nacross transport teardown, pinning svc_xprt references and\nblocking svc_rdma_free().\n\nThe close path sets XPT_CLOSE before invoking xpo_detach and both\nwait_event predicates include an XPT_CLOSE term, but the\npredicates are re-evaluated only on wakeup. sc_sq_ticket_wait has\nno completion-driven wake path; it is advanced solely by the\nchained ticket handoff inside svc_rdma_sq_wait() itself. Without\nan explicit wake at close, parked threads never observe\nXPT_CLOSE, hold their svc_xprt_get reference forever, and\nsvc_rdma_free() blocks on xpt_ref dropping to zero.\n\nTwo close entry points reach this transport. Local teardown runs\nsvc_rdma_detach() from svc_handle_xprt() -\u003e svc_delete_xprt() -\u003e\nxpo_detach() on a worker thread. A remote disconnect arrives at\nsvc_rdma_cma_handler(), which calls svc_xprt_deferred_close():\nthat sets XPT_CLOSE and enqueues the transport but does not\naccess either RDMA waitqueue, so a worker already parked in\nsvc_rdma_sq_wait() never re-evaluates its predicate. With every\nworker parked on this transport, no thread is available to run\nthe local teardown either, and the wake site there is\nunreachable.\n\nIntroduce svc_rdma_xprt_deferred_close(), a thin svcrdma wrapper\nthat calls svc_xprt_deferred_close() and then wakes both\nsc_sq_ticket_wait and sc_send_wait. Convert the svcrdma producers\nthat called svc_xprt_deferred_close() directly:\nsvc_rdma_cma_handler(), qp_event_handler(),\nsvc_rdma_post_send_err(), svc_rdma_wc_send(), the sendto drop\npath, the rw completion error paths, and the recvfrom flush and\nread-list error paths.\n\nWake both waitqueues from svc_rdma_detach() as well. The\nsynchronous svc_xprt_close() path (backchannel ENOTCONN, device\nremoval via svc_rdma_xprt_done) reaches detach without flowing\nthrough svc_xprt_deferred_close() and therefore does not invoke\nthe new helper.\n\n[ cel: add svc_rdma_xprt_deferred_close() to complete the fix ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated peer can reach the vulnerable NFS/RDMA server over an IP-based RDMA connection, including routable iWARP or RoCE deployments.\nAC:L - The attacker controls concurrent request batching, Send Queue pressure, and the remote disconnect that strands waiters, and can repeat attempts without relying on an uncontrollable race.\nPR:N - Malformed RPC/RDMA headers can reach svc_rdma_sq_wait() through the transport-error reply path before RPC authentication, NFS export authorization, or credential validation.\nUI:N - Exploitation requires only attacker-generated RDMA traffic and disconnection; no victim action is required after the service is listening.\nS:U - The vulnerable transport and affected NFS service threads belong to the same host kernel security authority.\nC:N - The defect is a missed wake-up that pins references and does not disclose data or provide a memory-read primitive.\nI:N - No memory corruption, unintended write, or data modification occurs; retained references prevent premature object destruction.\nA:H - Waiters remain indefinitely in TASK_UNINTERRUPTIBLE, and an attacker can park all NFS service workers and block transport teardown or server shutdown, causing complete service availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:36.535Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40eedc4253dbda0b29b7961200534dfcecb48ace"
},
{
"url": "https://git.kernel.org/stable/c/e5248a7426030db1e126363f72afdb3b71339a5c"
}
],
"title": "svcrdma: wake sq waiters when the transport closes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64281",
"datePublished": "2026-07-25T08:49:24.399Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-08-17T04:52:36.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64280 (GCVE-0-2026-64280)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-23 12:45
VLAI
EPSS
VEX
Title
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
afu_ioctl_dma_map() accepts a 64-bit length from userspace via
DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value
is passed to afu_dma_pin_pages() where npages is derived as
length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes
int nr_pages, causing implicit truncation if length is very large.
Validate map.length at the ioctl entry point before calling
afu_dma_map_region(), rejecting values whose page count exceeds
INT_MAX.
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fa8dda1edef9ebc3af467c644c5533ac97171e12 , < 5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc
(git)
Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < d7e787eee2ea619b6dbb98890472ee73daf2e7fd (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < a6a3884ff500f04f3088d6d09eec803cd35331a2 (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < 16381bda90b261a656ded0568630c1b857b2ebc8 (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < b50e6cd2395cde615f59b624819998d28c0668d6 (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < 59070040fd12e0b78d7b4d341d9f9a183237c5ff (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231 (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27 (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/fpga/dfl-afu-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
},
{
"lessThan": "d7e787eee2ea619b6dbb98890472ee73daf2e7fd",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
},
{
"lessThan": "a6a3884ff500f04f3088d6d09eec803cd35331a2",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
},
{
"lessThan": "16381bda90b261a656ded0568630c1b857b2ebc8",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
},
{
"lessThan": "b50e6cd2395cde615f59b624819998d28c0668d6",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
},
{
"lessThan": "59070040fd12e0b78d7b4d341d9f9a183237c5ff",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
},
{
"lessThan": "fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
},
{
"lessThan": "fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27",
"status": "affected",
"version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/fpga/dfl-afu-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()\n\nafu_ioctl_dma_map() accepts a 64-bit length from userspace via\nDFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value\nis passed to afu_dma_pin_pages() where npages is derived as\nlength \u003e\u003e PAGE_SHIFT and passed to pin_user_pages_fast() which takes\nint nr_pages, causing implicit truncation if length is very large.\n\nValidate map.length at the ioctl entry point before calling\nafu_dma_map_region(), rejecting values whose page count exceeds\nINT_MAX."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached locally through DFL_FPGA_PORT_DMA_MAP on a /dev/dfl-port.* character device.\nAC:L - A page-aligned length whose page count wraps to zero or a small positive integer deterministically triggers the mismatch; no race or condition outside the attacker\u2019s control is required.\nPR:L - The ioctl contains no capability or namespace privilege check, so any unprivileged user granted access to the port device can trigger it.\nUI:N - The attacker independently opens the device and submits the malicious ioctl without any victim action.\nS:C - The oversized DMA mapping can cross the IOMMU-enforced boundary between the assigned user buffer and host physical memory, affecting kernel and other-user resources.\nC:H - A small positive page-count wrap can create an enormous DMA-readable mapping after pinning only a few pages, exposing host memory beyond the authorized buffer; teardown also performs unbounded out-of-bounds pointer reads.\nI:H - The mapping is DMA_BIDIRECTIONAL, permitting writes beyond the pinned buffer, while the oversized unpin operation can corrupt unrelated page reference counts through out-of-bounds page pointers.\nA:H - A zero page-count wrap causes a deterministic pages[0] dereference from a zero-sized allocation, while other wrapped counts can produce an unbounded unpin traversal and kernel crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:39.157Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc"
},
{
"url": "https://git.kernel.org/stable/c/d7e787eee2ea619b6dbb98890472ee73daf2e7fd"
},
{
"url": "https://git.kernel.org/stable/c/a6a3884ff500f04f3088d6d09eec803cd35331a2"
},
{
"url": "https://git.kernel.org/stable/c/16381bda90b261a656ded0568630c1b857b2ebc8"
},
{
"url": "https://git.kernel.org/stable/c/b50e6cd2395cde615f59b624819998d28c0668d6"
},
{
"url": "https://git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff"
},
{
"url": "https://git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231"
},
{
"url": "https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27"
}
],
"title": "fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64280",
"datePublished": "2026-07-25T08:49:23.753Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-08-23T12:45:39.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64279 (GCVE-0-2026-64279)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
i2c: core: fix adapter deregistration race
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix adapter deregistration race
Adapters can be looked up by their id using i2c_get_adapter() which
takes a reference to the embedded struct device.
Remove the adapter from the IDR before tearing it down during
deregistration (and on registration failure) to make sure its resources
are not accessed after having been freed (e.g. the device name).
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
35fc37f8188177e3ba3e7f99a6e3300e490e9181 , < d39282f552dd6c35b9b84b4af78f1198c24f3373
(git)
Affected: 35fc37f8188177e3ba3e7f99a6e3300e490e9181 , < 11dfa37bf544cc806f21742ca2fd2d841bd7032e (git) Affected: 35fc37f8188177e3ba3e7f99a6e3300e490e9181 , < 9882a9bd74db08e7bae5821a7050627ae92d3380 (git) Affected: 35fc37f8188177e3ba3e7f99a6e3300e490e9181 , < bb234487a447a99315add1b46aa57b72e163e1eb (git) Affected: 35fc37f8188177e3ba3e7f99a6e3300e490e9181 , < b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3 (git) Affected: 35fc37f8188177e3ba3e7f99a6e3300e490e9181 , < 35dbd1f1f603401155cbd3a180bb18e3a3b675b8 (git) Affected: 35fc37f8188177e3ba3e7f99a6e3300e490e9181 , < b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f (git) |
|
| Linux | Linux |
Affected:
2.6.31
Unaffected: 0 , < 2.6.31 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-core-base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d39282f552dd6c35b9b84b4af78f1198c24f3373",
"status": "affected",
"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181",
"versionType": "git"
},
{
"lessThan": "11dfa37bf544cc806f21742ca2fd2d841bd7032e",
"status": "affected",
"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181",
"versionType": "git"
},
{
"lessThan": "9882a9bd74db08e7bae5821a7050627ae92d3380",
"status": "affected",
"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181",
"versionType": "git"
},
{
"lessThan": "bb234487a447a99315add1b46aa57b72e163e1eb",
"status": "affected",
"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181",
"versionType": "git"
},
{
"lessThan": "b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3",
"status": "affected",
"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181",
"versionType": "git"
},
{
"lessThan": "35dbd1f1f603401155cbd3a180bb18e3a3b675b8",
"status": "affected",
"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181",
"versionType": "git"
},
{
"lessThan": "b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f",
"status": "affected",
"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-core-base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix adapter deregistration race\n\nAdapters can be looked up by their id using i2c_get_adapter() which\ntakes a reference to the embedded struct device.\n\nRemove the adapter from the IDR before tearing it down during\nderegistration (and on registration failure) to make sure its resources\nare not accessed after having been freed (e.g. the device name)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the vulnerable lookup through local open/openat calls on /dev/i2c-N and can trigger dynamic-adapter teardown through local usbfs ioctls. No network path directly reaches i2c_get_adapter().\nAC:L - An attacker with access to both device nodes can control both sides by racing parallel I2C opens against repeatable USBDEVFS_DISCONNECT and rebind operations. No victim-controlled timing or uncontrollable condition is required.\nPR:L - i2cdev_open() and the usbfs disconnect path impose device-node DAC, LSM, and device-cgroup checks but no capability requirement. A regular user granted I2C and USB-device access can trigger the race without init-namespace root.\nUI:N - The attacker can initiate the adapter lookup, software disconnect, and subsequent stale-adapter operations directly. No separate victim action is required.\nS:U - Exploitation corrupts or executes code within the same host kernel security authority. This is ordinary local kernel privilege escalation rather than a VM, IOMMU, or other scope-boundary escape.\nC:H - The race can return an adapter after its embedded device resources have been released, followed by freeing of the enclosing dynamic-adapter allocation. Reclaiming this heap object permits attacker-influenced pointer dereferences and potential arbitrary kernel-memory disclosure.\nI:H - The stale adapter contains algorithm and locking function pointers, while I2C ioctls also write mutable adapter fields. Heap reclamation can therefore provide memory-corruption and control-flow-hijacking primitives leading to kernel code execution.\nA:H - Refcount resurrection, stale device-resource accesses, and dereferences through a freed adapter can produce kernel warnings, oopses, or panics. An attacker controlling disconnect and rebind can repeat the trigger."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:34.328Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373"
},
{
"url": "https://git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e"
},
{
"url": "https://git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380"
},
{
"url": "https://git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb"
},
{
"url": "https://git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3"
},
{
"url": "https://git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8"
},
{
"url": "https://git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f"
}
],
"title": "i2c: core: fix adapter deregistration race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64279",
"datePublished": "2026-07-25T08:49:23.145Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-08-17T04:52:34.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64278 (GCVE-0-2026-64278)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
On some i.MX platforms, certain I2C client drivers keep a periodic
workqueue which continues to trigger I2C transfers.
During system suspend/resume, there exists a time window between:
- suspend_noirq and the system entering suspend
- the system starting to resume and resume_noirq
In this window, the I2C controller resources such as clock and pinctrl
may already be disabled or not yet restored.
If a workqueue triggers an I2C transfer in this period, the driver
attempts to access I2C registers while the hardware resources are
unavailable, which may lead to system hang.
Mark the I2C adapter as suspended during noirq suspend and block new
transfers until resume, ensuring that I2C transfers are only issued
when hardware resources are available.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1ee867e465c1b0216ec02d4c0d334c4e89919cec , < b2523f26979e0b5bd1422772176b2233fcd1f6d0
(git)
Affected: 1ee867e465c1b0216ec02d4c0d334c4e89919cec , < 5800647d19d3f1f747fda4dc67e55d6afa6ee119 (git) Affected: 1ee867e465c1b0216ec02d4c0d334c4e89919cec , < 218cfe364b55b2768221629bd4a69ad190b7fbbc (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-imx-lpi2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b2523f26979e0b5bd1422772176b2233fcd1f6d0",
"status": "affected",
"version": "1ee867e465c1b0216ec02d4c0d334c4e89919cec",
"versionType": "git"
},
{
"lessThan": "5800647d19d3f1f747fda4dc67e55d6afa6ee119",
"status": "affected",
"version": "1ee867e465c1b0216ec02d4c0d334c4e89919cec",
"versionType": "git"
},
{
"lessThan": "218cfe364b55b2768221629bd4a69ad190b7fbbc",
"status": "affected",
"version": "1ee867e465c1b0216ec02d4c0d334c4e89919cec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-imx-lpi2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx-lpi2c: mark I2C adapter when hardware is powered down\n\nOn some i.MX platforms, certain I2C client drivers keep a periodic\nworkqueue which continues to trigger I2C transfers.\n\nDuring system suspend/resume, there exists a time window between:\n - suspend_noirq and the system entering suspend\n - the system starting to resume and resume_noirq\n\nIn this window, the I2C controller resources such as clock and pinctrl\nmay already be disabled or not yet restored.\n\nIf a workqueue triggers an I2C transfer in this period, the driver\nattempts to access I2C registers while the hardware resources are\nunavailable, which may lead to system hang.\n\nMark the I2C adapter as suspended during noirq suspend and block new\ntransfers until resume, ensuring that I2C transfers are only issued\nwhen hardware resources are available."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:33.233Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b2523f26979e0b5bd1422772176b2233fcd1f6d0"
},
{
"url": "https://git.kernel.org/stable/c/5800647d19d3f1f747fda4dc67e55d6afa6ee119"
},
{
"url": "https://git.kernel.org/stable/c/218cfe364b55b2768221629bd4a69ad190b7fbbc"
}
],
"title": "i2c: imx-lpi2c: mark I2C adapter when hardware is powered down",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64278",
"datePublished": "2026-07-25T08:49:22.535Z",
"dateReserved": "2026-07-19T15:36:31.776Z",
"dateUpdated": "2026-08-17T04:52:33.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64277 (GCVE-0-2026-64277)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates gpio_key_map with
min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f3a_attention() iterates the full gpio_count and dereferences
gpio_key_map[i], and input->keycodemax is set to the full gpio_count
while input->keycode points at the 6-entry allocation.
A device that reports gpio_count > 6 therefore causes an out-of-bounds
read of gpio_key_map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input_default_getkeycode() and
input_default_setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio_count. The mapping loop is unchanged:
it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)
entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)
and are skipped when reporting.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9e4c596bfd004f447a652205163234dfd4aafa69 , < 502ad7caaa1a445b734c827fa256e5311df67e3d
(git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 3480e24bc4e178aaa009edb25b6ee12df199e210 (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 35ed74d32d8260bdfb14a94caf402bf0866bdeec (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < ba57f430328534501962d60d651e385ffd7af9ca (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 850117b637bcb1dcc14be0cf09ac819a8707b42c (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 8db211aed83733073b0814adaeeab61d4521474e (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42 (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 57c10915f2c16c90e0d46ad00876bf39ece40fc2 (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f3a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "502ad7caaa1a445b734c827fa256e5311df67e3d",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
},
{
"lessThan": "3480e24bc4e178aaa009edb25b6ee12df199e210",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
},
{
"lessThan": "35ed74d32d8260bdfb14a94caf402bf0866bdeec",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
},
{
"lessThan": "ba57f430328534501962d60d651e385ffd7af9ca",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
},
{
"lessThan": "850117b637bcb1dcc14be0cf09ac819a8707b42c",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
},
{
"lessThan": "8db211aed83733073b0814adaeeab61d4521474e",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
},
{
"lessThan": "64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
},
{
"lessThan": "57c10915f2c16c90e0d46ad00876bf39ece40fc2",
"status": "affected",
"version": "9e4c596bfd004f447a652205163234dfd4aafa69",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f3a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a-\u003egpio_count = buf \u0026 RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input-\u003ekeycodemax is set to the full gpio_count\nwhile input-\u003ekeycode points at the 6-entry allocation.\n\nA device that reports gpio_count \u003e 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core\u0027s default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The highest-severity defensible path is local: a process that can open the affected RMI touchpad\u0027s evdev node can invoke the vulnerable keymap ioctls. A malicious USB RMI device is also a physical trigger, but the local ioctl path is more severe.\nAC:L - On a vulnerable device reporting more than six GPIOs, selecting any keymap index from 6 through gpio_count-1 deterministically accesses beyond the allocation. No race or condition outside the attacker\u0027s control is required.\nPR:L - The evdev keymap ioctl path has no capability or authentication check; only ordinary device-node access controls apply. An unprivileged user with seat, ACL, or input-device access can exploit it without administrative capabilities.\nUI:N - The attacker directly issues EVIOCGKEYCODE or EVIOCSKEYCODE after opening the node. No action by another user is required.\nS:U - Exploitation compromises the host kernel within the same security authority. It does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - EVIOCGKEYCODE can disclose successive 16-bit words across as much as 242 bytes beyond the six-entry keymap, exposing adjacent slab contents and potentially kernel pointers. The accompanying corruption can also support stronger disclosure primitives.\nI:H - EVIOCSKEYCODE provides indexed, caller-controlled 16-bit writes throughout the out-of-bounds range. This heap corruption can overwrite adjacent pointers or control data and plausibly enable kernel code execution.\nA:H - The controlled heap overwrite can corrupt adjacent slab objects and cause a kernel oops or panic, while device attention interrupts repeatedly exercise the out-of-bounds read. The failure can be triggered repeatedly without victim interaction."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:32.147Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"
},
{
"url": "https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"
},
{
"url": "https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"
},
{
"url": "https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"
},
{
"url": "https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"
},
{
"url": "https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"
},
{
"url": "https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"
},
{
"url": "https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"
}
],
"title": "Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64277",
"datePublished": "2026-07-25T08:49:21.936Z",
"dateReserved": "2026-07-19T15:36:31.776Z",
"dateUpdated": "2026-08-17T04:52:32.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64276 (GCVE-0-2026-64276)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 8c6d18d61bb6fe0e6edf848413391c590552e8a9
(git)
Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < d162a1ead7de404d8b41a093c83ed0db6487cded (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < f0be9eba946e9200b43265e0a748d38bd0a56954 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 26c895928d7118436a24f564587cb4aefc40cdd8 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 4e3689c26854356f41fbaa1eafa382e58ac79e00 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < e849c6f51e6877104c765da084e001ec37c8e119 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < bfe622efecd4ff0a792d0ecd1a8dce535a902f50 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < d577e46785d45484b2ab7e7309c49b18764bf56c (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f30.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c6d18d61bb6fe0e6edf848413391c590552e8a9",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
},
{
"lessThan": "d162a1ead7de404d8b41a093c83ed0db6487cded",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
},
{
"lessThan": "f0be9eba946e9200b43265e0a748d38bd0a56954",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
},
{
"lessThan": "26c895928d7118436a24f564587cb4aefc40cdd8",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
},
{
"lessThan": "4e3689c26854356f41fbaa1eafa382e58ac79e00",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
},
{
"lessThan": "e849c6f51e6877104c765da084e001ec37c8e119",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
},
{
"lessThan": "bfe622efecd4ff0a792d0ecd1a8dce535a902f50",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
},
{
"lessThan": "d577e46785d45484b2ab7e7309c49b18764bf56c",
"status": "affected",
"version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f30.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30-\u003egpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput-\u003ekeycodemax is set to the full gpioled_count while input-\u003ekeycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count \u003e 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An unprivileged local process that can open the affected /dev/input/event node can reach the flawed table through EVIOCGKEYCODE or EVIOCSKEYCODE; no physical reattachment or network path is required on systems with an affected F30 device.\nAC:L - Once an F30 device reports more than six GPIO/LEDs, attacker-selected indices deterministically trigger two-byte heap out-of-bounds reads or writes. No race or condition outside the attacker\u0027s control is required.\nPR:L - The evdev ioctl path contains no capability or namespace privilege check, so any ordinary user permitted to open the event node can trigger it.\nUI:N - The attacker directly issues the ioctls, and the separate attention path is device-driven; neither requires action by another user.\nS:U - The vulnerable driver and the affected kernel memory share the same security authority. Kernel privilege escalation or code execution does not itself cross a VM, IOMMU, or other scope boundary.\nC:H - EVIOCGKEYCODE returns attacker-selected out-of-bounds u16 values and can disclose multiple adjacent slab words across the available indices. This heap disclosure can expose security-sensitive kernel data and facilitate further exploitation.\nI:H - EVIOCSKEYCODE performs attacker-controlled u16 writes beyond the allocation at selectable offsets. These writes can corrupt adjacent heap objects or metadata and plausibly enable control-flow hijacking.\nA:H - The controlled heap corruption can damage adjacent kernel objects and cause an oops or panic, while the device can also repeatedly trigger the out-of-bounds attention path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:31.046Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9"
},
{
"url": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded"
},
{
"url": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954"
},
{
"url": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8"
},
{
"url": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00"
},
{
"url": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119"
},
{
"url": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50"
},
{
"url": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c"
}
],
"title": "Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64276",
"datePublished": "2026-07-25T08:49:21.300Z",
"dateReserved": "2026-07-19T15:36:31.776Z",
"dateUpdated": "2026-08-17T04:52:31.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64275 (GCVE-0-2026-64275)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
Input: elan_i2c - prevent division by zero and arithmetic underflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: elan_i2c - prevent division by zero and arithmetic underflow
The Elan I2C touchpad driver queries the device for its physical
dimensions and trace counts to calculate the device resolution and width.
However, if the device firmware or device tree provides invalid zero
values for x_traces or y_traces, it results in a fatal division-by-zero
exception leading to a kernel panic during device probe.
Add checks to ensure these parameters are non-zero before performing
the division. If invalid trace values are detected, fall back to a safe
default of 1.
Additionally, prevent an arithmetic underflow in the touch reporting
logic. Previously, if the calculated or fallback width was smaller than
ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a
massive unsigned integer being reported to userspace. Clamp the adjusted
width to a minimum of 0 to safely handle small physical dimensions and
fallback scenarios.
Completing the probe with safe fallback values ensures the sysfs nodes
are created, keeping the firmware update path intact so a recovery
firmware can be flashed to the device.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6696777c6506fa52b2a0282121195843ed855be6 , < 59d4cc5e7a9785e4bdc9c55273274c6b49d4b58d
(git)
Affected: 6696777c6506fa52b2a0282121195843ed855be6 , < f6d10af2036d1d4a847a74fe47ebbf93bce3c84c (git) Affected: 6696777c6506fa52b2a0282121195843ed855be6 , < 2f281ff0163a38fdc4cb4061f0c241e643283a5e (git) Affected: 6696777c6506fa52b2a0282121195843ed855be6 , < 8c1db3418a419e788691746b9c47f863c2fd4890 (git) Affected: 6696777c6506fa52b2a0282121195843ed855be6 , < feb4866a42ec94764c7eb58012256f6f37664727 (git) Affected: 6696777c6506fa52b2a0282121195843ed855be6 , < 01e0317c256c560d8dcce2e9825eb6142ee34611 (git) Affected: 6696777c6506fa52b2a0282121195843ed855be6 , < 6bac57d8fe2a077b8a85b4140eeb7999078158eb (git) Affected: 6696777c6506fa52b2a0282121195843ed855be6 , < df2b818fa009c10ff6ba875a1663ff001cda9558 (git) |
|
| Linux | Linux |
Affected:
3.19
Unaffected: 0 , < 3.19 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/elan_i2c_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59d4cc5e7a9785e4bdc9c55273274c6b49d4b58d",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
},
{
"lessThan": "f6d10af2036d1d4a847a74fe47ebbf93bce3c84c",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
},
{
"lessThan": "2f281ff0163a38fdc4cb4061f0c241e643283a5e",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
},
{
"lessThan": "8c1db3418a419e788691746b9c47f863c2fd4890",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
},
{
"lessThan": "feb4866a42ec94764c7eb58012256f6f37664727",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
},
{
"lessThan": "01e0317c256c560d8dcce2e9825eb6142ee34611",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
},
{
"lessThan": "6bac57d8fe2a077b8a85b4140eeb7999078158eb",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
},
{
"lessThan": "df2b818fa009c10ff6ba875a1663ff001cda9558",
"status": "affected",
"version": "6696777c6506fa52b2a0282121195843ed855be6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/elan_i2c_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: elan_i2c - prevent division by zero and arithmetic underflow\n\nThe Elan I2C touchpad driver queries the device for its physical\ndimensions and trace counts to calculate the device resolution and width.\nHowever, if the device firmware or device tree provides invalid zero\nvalues for x_traces or y_traces, it results in a fatal division-by-zero\nexception leading to a kernel panic during device probe.\n\nAdd checks to ensure these parameters are non-zero before performing\nthe division. If invalid trace values are detected, fall back to a safe\ndefault of 1.\n\nAdditionally, prevent an arithmetic underflow in the touch reporting\nlogic. Previously, if the calculated or fallback width was smaller than\nETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a\nmassive unsigned integer being reported to userspace. Clamp the adjusted\nwidth to a minimum of 0 to safely handle small physical dimensions and\nfallback scenarios.\n\nCompleting the probe with safe fallback values ensures the sysfs nodes\nare created, keeping the firmware update path intact so a recovery\nfirmware can be flashed to the device."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:29.928Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59d4cc5e7a9785e4bdc9c55273274c6b49d4b58d"
},
{
"url": "https://git.kernel.org/stable/c/f6d10af2036d1d4a847a74fe47ebbf93bce3c84c"
},
{
"url": "https://git.kernel.org/stable/c/2f281ff0163a38fdc4cb4061f0c241e643283a5e"
},
{
"url": "https://git.kernel.org/stable/c/8c1db3418a419e788691746b9c47f863c2fd4890"
},
{
"url": "https://git.kernel.org/stable/c/feb4866a42ec94764c7eb58012256f6f37664727"
},
{
"url": "https://git.kernel.org/stable/c/01e0317c256c560d8dcce2e9825eb6142ee34611"
},
{
"url": "https://git.kernel.org/stable/c/6bac57d8fe2a077b8a85b4140eeb7999078158eb"
},
{
"url": "https://git.kernel.org/stable/c/df2b818fa009c10ff6ba875a1663ff001cda9558"
}
],
"title": "Input: elan_i2c - prevent division by zero and arithmetic underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64275",
"datePublished": "2026-07-25T08:49:20.669Z",
"dateReserved": "2026-07-19T15:36:31.776Z",
"dateUpdated": "2026-08-17T04:52:29.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64274 (GCVE-0-2026-64274)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
Input: goodix - clamp the device-reported contact count
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: goodix - clamp the device-reported contact count
goodix_ts_read_input_report() copies the number of touch points reported
by the device into an on-stack buffer
u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];
which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only
runtime check bounds the per-interrupt count against ts->max_touch_num,
but that value is taken verbatim from a 4-bit field of the device
configuration block and is never clamped:
ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;
The nibble can be 0..15, so a malfunctioning, malicious or counterfeit
controller (or an attacker tampering with the I2C bus) can advertise up
to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num
of up to 15 and the second goodix_i2c_read() writes
ts->contact_size * (touch_num - 1) bytes past the one-contact header into
point_data - up to 30 bytes (45 with the 9-byte report format) beyond the
92-byte buffer: a stack out-of-bounds write.
Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts
point_data[] is sized for, when reading it from the configuration.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < e825f352ef5271255cd08cc994b0dc25648a2f38
(git)
Affected: a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < 4bfea9c3a0981c1c7fc5d1a1b27197b2de247902 (git) Affected: a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < 98b2caef249183b572c04451365246f919707845 (git) Affected: a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < 719d1a2c83a46be6bf81af905e4f6adb3d32dc28 (git) Affected: a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < 46addbd13dbf4aacb71cfbca964a5e552d0f45ae (git) Affected: a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < 3b32303460155603d25444274856013d211d5e1f (git) Affected: a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < 2a67668690129953e898923260a2dd1c7c196495 (git) Affected: a7ac7c95d4682883d141c5d7a7544d2818f0a09f , < 5ed62a96e06be4e94b8296b7932afee550a70e04 (git) |
|
| Linux | Linux |
Affected:
4.1
Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/goodix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e825f352ef5271255cd08cc994b0dc25648a2f38",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
},
{
"lessThan": "4bfea9c3a0981c1c7fc5d1a1b27197b2de247902",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
},
{
"lessThan": "98b2caef249183b572c04451365246f919707845",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
},
{
"lessThan": "719d1a2c83a46be6bf81af905e4f6adb3d32dc28",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
},
{
"lessThan": "46addbd13dbf4aacb71cfbca964a5e552d0f45ae",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
},
{
"lessThan": "3b32303460155603d25444274856013d211d5e1f",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
},
{
"lessThan": "2a67668690129953e898923260a2dd1c7c196495",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
},
{
"lessThan": "5ed62a96e06be4e94b8296b7932afee550a70e04",
"status": "affected",
"version": "a7ac7c95d4682883d141c5d7a7544d2818f0a09f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/goodix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: goodix - clamp the device-reported contact count\n\ngoodix_ts_read_input_report() copies the number of touch points reported\nby the device into an on-stack buffer\n\n\tu8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];\n\nwhich is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only\nruntime check bounds the per-interrupt count against ts-\u003emax_touch_num,\nbut that value is taken verbatim from a 4-bit field of the device\nconfiguration block and is never clamped:\n\n\tts-\u003emax_touch_num = ts-\u003econfig[MAX_CONTACTS_LOC] \u0026 0x0f;\n\nThe nibble can be 0..15, so a malfunctioning, malicious or counterfeit\ncontroller (or an attacker tampering with the I2C bus) can advertise up\nto 15 contacts. goodix_ts_read_input_report() then accepts a touch_num\nof up to 15 and the second goodix_i2c_read() writes\nts-\u003econtact_size * (touch_num - 1) bytes past the one-contact header into\npoint_data - up to 30 bytes (45 with the 9-byte report format) beyond the\n92-byte buffer: a stack out-of-bounds write.\n\nClamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts\npoint_data[] is sized for, when reading it from the configuration."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:28.842Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e825f352ef5271255cd08cc994b0dc25648a2f38"
},
{
"url": "https://git.kernel.org/stable/c/4bfea9c3a0981c1c7fc5d1a1b27197b2de247902"
},
{
"url": "https://git.kernel.org/stable/c/98b2caef249183b572c04451365246f919707845"
},
{
"url": "https://git.kernel.org/stable/c/719d1a2c83a46be6bf81af905e4f6adb3d32dc28"
},
{
"url": "https://git.kernel.org/stable/c/46addbd13dbf4aacb71cfbca964a5e552d0f45ae"
},
{
"url": "https://git.kernel.org/stable/c/3b32303460155603d25444274856013d211d5e1f"
},
{
"url": "https://git.kernel.org/stable/c/2a67668690129953e898923260a2dd1c7c196495"
},
{
"url": "https://git.kernel.org/stable/c/5ed62a96e06be4e94b8296b7932afee550a70e04"
}
],
"title": "Input: goodix - clamp the device-reported contact count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64274",
"datePublished": "2026-07-25T08:49:20.040Z",
"dateReserved": "2026-07-19T15:36:31.776Z",
"dateUpdated": "2026-08-17T04:52:28.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64273 (GCVE-0-2026-64273)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
Input: iforce - bound the device-reported force-feedback effect index
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: iforce - bound the device-reported force-feedback effect index
iforce_process_packet() handles a status report (packet id 0x02) by
taking a force-feedback effect index straight from the device wire and
using it to address the per-effect state array:
i = data[1] & 0x7f;
if (data[1] & 0x80) {
if (!test_and_set_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags))
...
} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags)) {
...
}
The index is masked only with 0x7f, so it ranges 0..127, but
core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index
of 32..127 the test_and_set_bit()/test_and_clear_bit() is an
out-of-bounds single-bit read-modify-write past the array. core_effects[]
is the second-to-last member of struct iforce, so the write lands in the
trailing members and beyond the embedding kzalloc()'d iforce_serio /
iforce_usb object.
data[1] is unvalidated device payload on both transports (the USB
interrupt endpoint and serio), and the status path is not gated on force
feedback being present, so a malicious or counterfeit device can set or
clear a bit at an attacker-chosen offset past the object.
Reject an out-of-range index instead of indexing with it. Bound against
the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so
the check guarantees memory safety regardless of how many effects the
device registered. A legitimate "effect started/stopped" status always
carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are
unaffected; the neighbouring mark_core_as_ready() loop is already bounded
and is left untouched.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d10b0507fa0f5b46764b178e3271f9012f2df677 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6c0f2901c9d325d4a0574c4237fd507810d225ff (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c21295616a8a52b9a5f18cd4ca8c73030eda3d4f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e5fa31f0550b55d80045669ae9080dd5b88abffa (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 70019779325f2bb5f5a4098e91e79c655f50fcef (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a40250f97c312e000e3616c9074022311a0efbc3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0e9943d2e4c63496b6ca84bc66fd3c71d40558e2 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/joystick/iforce/iforce-packets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d10b0507fa0f5b46764b178e3271f9012f2df677",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6c0f2901c9d325d4a0574c4237fd507810d225ff",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c21295616a8a52b9a5f18cd4ca8c73030eda3d4f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e5fa31f0550b55d80045669ae9080dd5b88abffa",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "70019779325f2bb5f5a4098e91e79c655f50fcef",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a40250f97c312e000e3616c9074022311a0efbc3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0e9943d2e4c63496b6ca84bc66fd3c71d40558e2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/joystick/iforce/iforce-packets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - bound the device-reported force-feedback effect index\n\niforce_process_packet() handles a status report (packet id 0x02) by\ntaking a force-feedback effect index straight from the device wire and\nusing it to address the per-effect state array:\n\n\ti = data[1] \u0026 0x7f;\n\tif (data[1] \u0026 0x80) {\n\t\tif (!test_and_set_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t iforce-\u003ecore_effects[i].flags))\n\t\t\t...\n\t} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t iforce-\u003ecore_effects[i].flags)) {\n\t\t...\n\t}\n\nThe index is masked only with 0x7f, so it ranges 0..127, but\ncore_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index\nof 32..127 the test_and_set_bit()/test_and_clear_bit() is an\nout-of-bounds single-bit read-modify-write past the array. core_effects[]\nis the second-to-last member of struct iforce, so the write lands in the\ntrailing members and beyond the embedding kzalloc()\u0027d iforce_serio /\niforce_usb object.\n\ndata[1] is unvalidated device payload on both transports (the USB\ninterrupt endpoint and serio), and the status path is not gated on force\nfeedback being present, so a malicious or counterfeit device can set or\nclear a bit at an attacker-chosen offset past the object.\n\nReject an out-of-range index instead of indexing with it. Bound against\nthe array dimension IFORCE_EFFECTS_MAX rather than dev-\u003eff-\u003emax_effects so\nthe check guarantees memory safety regardless of how many effects the\ndevice registered. A legitimate \"effect started/stopped\" status always\ncarries an index below IFORCE_EFFECTS_MAX, so well-formed devices are\nunaffected; the neighbouring mark_core_as_ready() loop is already bounded\nand is left untouched."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:27.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310"
},
{
"url": "https://git.kernel.org/stable/c/d10b0507fa0f5b46764b178e3271f9012f2df677"
},
{
"url": "https://git.kernel.org/stable/c/6c0f2901c9d325d4a0574c4237fd507810d225ff"
},
{
"url": "https://git.kernel.org/stable/c/c21295616a8a52b9a5f18cd4ca8c73030eda3d4f"
},
{
"url": "https://git.kernel.org/stable/c/e5fa31f0550b55d80045669ae9080dd5b88abffa"
},
{
"url": "https://git.kernel.org/stable/c/70019779325f2bb5f5a4098e91e79c655f50fcef"
},
{
"url": "https://git.kernel.org/stable/c/a40250f97c312e000e3616c9074022311a0efbc3"
},
{
"url": "https://git.kernel.org/stable/c/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2"
}
],
"title": "Input: iforce - bound the device-reported force-feedback effect index",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64273",
"datePublished": "2026-07-25T08:49:19.416Z",
"dateReserved": "2026-07-19T15:36:31.776Z",
"dateUpdated": "2026-08-17T04:52:27.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64272 (GCVE-0-2026-64272)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-23 12:45
VLAI
EPSS
VEX
Title
Input: mms114 - fix touch indexing for MMS134S and MMS136
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: mms114 - fix touch indexing for MMS134S and MMS136
The MMS134S and MMS136 touch controllers have an event size of 6 bytes
rather than 8 bytes. When __mms114_read_reg() reads the touch data
packet from the device into the touch buffer, the events are packed
tightly at 6-byte intervals. However, the driver iterates through the
events using standard C array indexing (touch[index]), where each
element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any
touch events beyond the first one are read from incorrect offsets and
parsed improperly.
Fix this by explicitly calculating the byte offset for each touch event
based on the device's specific event size.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
53fefdd1d3a3403d8c44e28898d1031d8763b913 , < 062bbe55a1f6d77b89d07135ba3b09f97bfac1cb
(git)
Affected: 53fefdd1d3a3403d8c44e28898d1031d8763b913 , < 38de2979d90d8cd94f18e0567be4c8342d0e0410 (git) Affected: 53fefdd1d3a3403d8c44e28898d1031d8763b913 , < 112666835071d935fef764aab590339e97216d4a (git) Affected: 53fefdd1d3a3403d8c44e28898d1031d8763b913 , < 7c00a0787af7164438bdbc97fcae9733cfc58d21 (git) Affected: 53fefdd1d3a3403d8c44e28898d1031d8763b913 , < 75b12874b4172533b9efc349db328cb1a59c3981 (git) Affected: 53fefdd1d3a3403d8c44e28898d1031d8763b913 , < a747c4eb02656afdbd92eea83b88e92715a23977 (git) Affected: 53fefdd1d3a3403d8c44e28898d1031d8763b913 , < a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d (git) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/mms114.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "062bbe55a1f6d77b89d07135ba3b09f97bfac1cb",
"status": "affected",
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"versionType": "git"
},
{
"lessThan": "38de2979d90d8cd94f18e0567be4c8342d0e0410",
"status": "affected",
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"versionType": "git"
},
{
"lessThan": "112666835071d935fef764aab590339e97216d4a",
"status": "affected",
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"versionType": "git"
},
{
"lessThan": "7c00a0787af7164438bdbc97fcae9733cfc58d21",
"status": "affected",
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"versionType": "git"
},
{
"lessThan": "75b12874b4172533b9efc349db328cb1a59c3981",
"status": "affected",
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"versionType": "git"
},
{
"lessThan": "a747c4eb02656afdbd92eea83b88e92715a23977",
"status": "affected",
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"versionType": "git"
},
{
"lessThan": "a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d",
"status": "affected",
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/mms114.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - fix touch indexing for MMS134S and MMS136\n\nThe MMS134S and MMS136 touch controllers have an event size of 6 bytes\nrather than 8 bytes. When __mms114_read_reg() reads the touch data\npacket from the device into the touch buffer, the events are packed\ntightly at 6-byte intervals. However, the driver iterates through the\nevents using standard C array indexing (touch[index]), where each\nelement is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any\ntouch events beyond the first one are read from incorrect offsets and\nparsed improperly.\n\nFix this by explicitly calculating the byte offset for each touch event\nbased on the device\u0027s specific event size."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:38.059Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/062bbe55a1f6d77b89d07135ba3b09f97bfac1cb"
},
{
"url": "https://git.kernel.org/stable/c/38de2979d90d8cd94f18e0567be4c8342d0e0410"
},
{
"url": "https://git.kernel.org/stable/c/112666835071d935fef764aab590339e97216d4a"
},
{
"url": "https://git.kernel.org/stable/c/7c00a0787af7164438bdbc97fcae9733cfc58d21"
},
{
"url": "https://git.kernel.org/stable/c/75b12874b4172533b9efc349db328cb1a59c3981"
},
{
"url": "https://git.kernel.org/stable/c/a747c4eb02656afdbd92eea83b88e92715a23977"
},
{
"url": "https://git.kernel.org/stable/c/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d"
}
],
"title": "Input: mms114 - fix touch indexing for MMS134S and MMS136",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64272",
"datePublished": "2026-07-25T08:49:18.766Z",
"dateReserved": "2026-07-19T15:36:31.775Z",
"dateUpdated": "2026-08-23T12:45:38.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64271 (GCVE-0-2026-64271)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
EPSS
VEX
Title
Input: touchwin - reset the packet index on every complete packet
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: touchwin - reset the packet index on every complete packet
tw_interrupt() accumulates each non-zero serial byte into a fixed
three-byte buffer with a running index that is only reset once a full
packet has been received *and* the device's two Y bytes agree:
tw->data[tw->idx++] = data;
if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
...
tw->idx = 0;
}
The reset is gated on tw->data[1] == tw->data[2], a value the device
controls. A malicious, malfunctioning or counterfeit Touchwindow
peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
index reaches TW_LENGTH without the equality holding, is never reset, and
keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen
byte at a time -- an unbounded, device-driven heap out-of-bounds write.
Reset the index on every completed packet and report an event only when
the two Y bytes match, like the other serio touchscreen drivers do.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
11ea3173d5f2de71d037ef58ac43395795fed2bc , < ed9b66905407eb3d02df1aaeed82eb7a7f0eb508
(git)
Affected: 11ea3173d5f2de71d037ef58ac43395795fed2bc , < 044167cba2384bcd783547ad5e30ecd292b30919 (git) Affected: 11ea3173d5f2de71d037ef58ac43395795fed2bc , < 6c9f29f128dd4057404838259af4c645318487e1 (git) Affected: 11ea3173d5f2de71d037ef58ac43395795fed2bc , < 431ad239f2924dff337c3fccb9246597c1b63185 (git) Affected: 11ea3173d5f2de71d037ef58ac43395795fed2bc , < 70e4248793762df9832fd4fc2fc6ac7924572c36 (git) Affected: 11ea3173d5f2de71d037ef58ac43395795fed2bc , < 3e6f007b43e2fc6546e21fa74ee62c38984a6672 (git) Affected: 11ea3173d5f2de71d037ef58ac43395795fed2bc , < a8d87184576c889759e3aab899799a482f1e1a5b (git) Affected: 11ea3173d5f2de71d037ef58ac43395795fed2bc , < 478cdd736f2ce3114f90e775d7358136d3977b94 (git) |
|
| Linux | Linux |
Affected:
2.6.19
Unaffected: 0 , < 2.6.19 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/touchwin.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed9b66905407eb3d02df1aaeed82eb7a7f0eb508",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
},
{
"lessThan": "044167cba2384bcd783547ad5e30ecd292b30919",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
},
{
"lessThan": "6c9f29f128dd4057404838259af4c645318487e1",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
},
{
"lessThan": "431ad239f2924dff337c3fccb9246597c1b63185",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
},
{
"lessThan": "70e4248793762df9832fd4fc2fc6ac7924572c36",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
},
{
"lessThan": "3e6f007b43e2fc6546e21fa74ee62c38984a6672",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
},
{
"lessThan": "a8d87184576c889759e3aab899799a482f1e1a5b",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
},
{
"lessThan": "478cdd736f2ce3114f90e775d7358136d3977b94",
"status": "affected",
"version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/touchwin.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"lessThan": "2.6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: touchwin - reset the packet index on every complete packet\n\ntw_interrupt() accumulates each non-zero serial byte into a fixed\nthree-byte buffer with a running index that is only reset once a full\npacket has been received *and* the device\u0027s two Y bytes agree:\n\n\ttw-\u003edata[tw-\u003eidx++] = data;\n\tif (tw-\u003eidx == TW_LENGTH \u0026\u0026 tw-\u003edata[1] == tw-\u003edata[2]) {\n\t\t...\n\t\ttw-\u003eidx = 0;\n\t}\n\nThe reset is gated on tw-\u003edata[1] == tw-\u003edata[2], a value the device\ncontrols. A malicious, malfunctioning or counterfeit Touchwindow\nperipheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the\nindex reaches TW_LENGTH without the equality holding, is never reset, and\nkeeps growing, so tw-\u003edata[tw-\u003eidx++] walks off the end of the three-byte\narray and the rest of the heap-allocated struct tw, one attacker-chosen\nbyte at a time -- an unbounded, device-driven heap out-of-bounds write.\n\nReset the index on every completed packet and report an event only when\nthe two Y bytes match, like the other serio touchscreen drivers do."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:25.592Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508"
},
{
"url": "https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919"
},
{
"url": "https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1"
},
{
"url": "https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185"
},
{
"url": "https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36"
},
{
"url": "https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672"
},
{
"url": "https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b"
},
{
"url": "https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94"
}
],
"title": "Input: touchwin - reset the packet index on every complete packet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64271",
"datePublished": "2026-07-25T08:49:18.160Z",
"dateReserved": "2026-07-19T15:36:31.775Z",
"dateUpdated": "2026-08-17T04:52:25.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64270 (GCVE-0-2026-64270)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-23 12:45
VLAI
EPSS
VEX
Title
Input: mms114 - reject an oversized device packet size
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: mms114 - reject an oversized device packet size
mms114_interrupt() reads a packet of touch data from the device into a
fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
the device:
packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE);
if (packet_size <= 0)
goto out;
...
error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
(u8 *)touch);
packet_size is a single device register byte (0x0F) and the only check
is the lower bound packet_size <= 0; it is never bounded against the
size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of
up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject
an oversized packet and drop the report, consistent with the handler's
other error paths, rather than reading past the buffer.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
07b8481d4aff73d6f451f25e74ea10240ff5131e , < 040843281eebfa110d08fd7fb083fe6cb55cea14
(git)
Affected: 07b8481d4aff73d6f451f25e74ea10240ff5131e , < 39b12daf1adb80f9595fdfe584961deb80860cbb (git) Affected: 07b8481d4aff73d6f451f25e74ea10240ff5131e , < d99ba93c35ff2d5276e9c2632967481bd53a79d0 (git) Affected: 07b8481d4aff73d6f451f25e74ea10240ff5131e , < 5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6 (git) Affected: 07b8481d4aff73d6f451f25e74ea10240ff5131e , < b78150729762d47c14fe29a2582bdca5568e62b8 (git) Affected: 07b8481d4aff73d6f451f25e74ea10240ff5131e , < 8301c335305344d4da4ab9442b6a399dacfe5b8d (git) Affected: 07b8481d4aff73d6f451f25e74ea10240ff5131e , < f3d5e77b27fded71dcb97f409262bf0abba0410e (git) Affected: 07b8481d4aff73d6f451f25e74ea10240ff5131e , < 66725039f7090afe14c31bd259e2059a68f04023 (git) |
|
| Linux | Linux |
Affected:
3.6
Unaffected: 0 , < 3.6 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/mms114.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "040843281eebfa110d08fd7fb083fe6cb55cea14",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
},
{
"lessThan": "39b12daf1adb80f9595fdfe584961deb80860cbb",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
},
{
"lessThan": "d99ba93c35ff2d5276e9c2632967481bd53a79d0",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
},
{
"lessThan": "5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
},
{
"lessThan": "b78150729762d47c14fe29a2582bdca5568e62b8",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
},
{
"lessThan": "8301c335305344d4da4ab9442b6a399dacfe5b8d",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
},
{
"lessThan": "f3d5e77b27fded71dcb97f409262bf0abba0410e",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
},
{
"lessThan": "66725039f7090afe14c31bd259e2059a68f04023",
"status": "affected",
"version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/mms114.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - reject an oversized device packet size\n\nmms114_interrupt() reads a packet of touch data from the device into a\nfixed-size on-stack buffer\n\n\tstruct mms114_touch touch[MMS114_MAX_TOUCH];\n\nwhich holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,\ni.e. 80 bytes. The length of the I2C read into it is taken verbatim from\nthe device:\n\n\tpacket_size = mms114_read_reg(data, MMS114_PACKET_SIZE);\n\tif (packet_size \u003c= 0)\n\t\tgoto out;\n\t...\n\terror = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,\n\t\t\t(u8 *)touch);\n\npacket_size is a single device register byte (0x0F) and the only check\nis the lower bound packet_size \u003c= 0; it is never bounded against the\nsize of touch[]. A malfunctioning, malicious or counterfeit controller\n(or an attacker tampering with the I2C bus) can report a packet_size of\nup to 255, so __mms114_read_reg() writes up to 175 bytes past the end of\ntouch[] on the IRQ-thread stack: a stack out-of-bounds write that can\noverwrite the stack canary, saved registers and the return address.\n\nA well-formed device never reports more than the buffer holds, so reject\nan oversized packet and drop the report, consistent with the handler\u0027s\nother error paths, rather than reading past the buffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:36.926Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/040843281eebfa110d08fd7fb083fe6cb55cea14"
},
{
"url": "https://git.kernel.org/stable/c/39b12daf1adb80f9595fdfe584961deb80860cbb"
},
{
"url": "https://git.kernel.org/stable/c/d99ba93c35ff2d5276e9c2632967481bd53a79d0"
},
{
"url": "https://git.kernel.org/stable/c/5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6"
},
{
"url": "https://git.kernel.org/stable/c/b78150729762d47c14fe29a2582bdca5568e62b8"
},
{
"url": "https://git.kernel.org/stable/c/8301c335305344d4da4ab9442b6a399dacfe5b8d"
},
{
"url": "https://git.kernel.org/stable/c/f3d5e77b27fded71dcb97f409262bf0abba0410e"
},
{
"url": "https://git.kernel.org/stable/c/66725039f7090afe14c31bd259e2059a68f04023"
}
],
"title": "Input: mms114 - reject an oversized device packet size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64270",
"datePublished": "2026-07-25T08:49:17.541Z",
"dateReserved": "2026-07-19T15:36:31.775Z",
"dateUpdated": "2026-08-23T12:45:36.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64269 (GCVE-0-2026-64269)
Vulnerability from nvd – Published: 2026-07-25 08:49 – Updated: 2026-08-23 12:45
VLAI
EPSS
VEX
Title
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
When the server answers an RTRS READ, rdma_write_sg() builds the source
scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the
peer. Its length is taken directly from the wire descriptor:
plist->length = le32_to_cpu(id->rd_msg->desc[0].len);
rd_msg points into the chunk buffer that the remote peer filled via
RDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -> process_io_req() ->
process_read()), so desc[0].len is attacker-controlled and, before this
change, was only rejected when zero. The source address is the fixed
chunk start (dma_addr[msg_id]) and the source lkey is the PD-wide
local_dma_lkey, which is not tied to the chunk's MR mapping, so the verbs
layer does not constrain the transfer length to max_chunk_size. msg_id
and off are bounded against queue_depth and max_chunk_size in
rtrs_srv_rdma_done(), but desc[0].len is a separate field that was not
checked against the chunk size.
A peer that advertises desc[0].len larger than max_chunk_size can make
the posted RDMA write read past the chunk's mapped region. The resulting
behaviour depends on the IOMMU configuration: with no IOMMU or in
passthrough mode the read may extend into memory adjacent to the chunk
and be returned to the peer, which can disclose host memory; with a
translating IOMMU the out-of-range access is expected to fault and abort
the connection. In either case the transfer exceeds what the protocol
permits and is driven by a remote peer.
Reject a descriptor length above max_chunk_size, mirroring the existing
off >= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients
do not exceed it: the client sets desc[0].len to its MR length, which is
capped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE).
Severity
9.1 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9cb837480424e78ed585376f944088246685aec3 , < a35b7a8728a53ddc80b323970689fa5985816836
(git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 68c09762172f6224e9ddf9b0a60bacbb36e443eb (git) Affected: 9cb837480424e78ed585376f944088246685aec3 , < 6cada540150894e81042a0ae0c796a21a9a877da (git) Affected: 9cb837480424e78ed585376f944088246685aec3 , < 2912f3d40355dabc08fdbaaf2764d02445fe88dc (git) Affected: 9cb837480424e78ed585376f944088246685aec3 , < 6f40246f4312fdbab5a13cc440adebf95eb2aa66 (git) Affected: 9cb837480424e78ed585376f944088246685aec3 , < 5a45d0aa1fa50a333ce5763ade744e2d89838667 (git) Affected: 9cb837480424e78ed585376f944088246685aec3 , < da3e44add94b05dfde56f898421922f5cf35705f (git) Affected: 9cb837480424e78ed585376f944088246685aec3 , < 963af8d97a8c6a117134a8d0db1415e0489200b1 (git) |
|
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-srv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a35b7a8728a53ddc80b323970689fa5985816836",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
},
{
"lessThan": "68c09762172f6224e9ddf9b0a60bacbb36e443eb",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
},
{
"lessThan": "6cada540150894e81042a0ae0c796a21a9a877da",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
},
{
"lessThan": "2912f3d40355dabc08fdbaaf2764d02445fe88dc",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
},
{
"lessThan": "6f40246f4312fdbab5a13cc440adebf95eb2aa66",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
},
{
"lessThan": "5a45d0aa1fa50a333ce5763ade744e2d89838667",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
},
{
"lessThan": "da3e44add94b05dfde56f898421922f5cf35705f",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
},
{
"lessThan": "963af8d97a8c6a117134a8d0db1415e0489200b1",
"status": "affected",
"version": "9cb837480424e78ed585376f944088246685aec3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-srv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg\n\nWhen the server answers an RTRS READ, rdma_write_sg() builds the source\nscatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the\npeer. Its length is taken directly from the wire descriptor:\n\n plist-\u003elength = le32_to_cpu(id-\u003erd_msg-\u003edesc[0].len);\n\nrd_msg points into the chunk buffer that the remote peer filled via\nRDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -\u003e process_io_req() -\u003e\nprocess_read()), so desc[0].len is attacker-controlled and, before this\nchange, was only rejected when zero. The source address is the fixed\nchunk start (dma_addr[msg_id]) and the source lkey is the PD-wide\nlocal_dma_lkey, which is not tied to the chunk\u0027s MR mapping, so the verbs\nlayer does not constrain the transfer length to max_chunk_size. msg_id\nand off are bounded against queue_depth and max_chunk_size in\nrtrs_srv_rdma_done(), but desc[0].len is a separate field that was not\nchecked against the chunk size.\n\nA peer that advertises desc[0].len larger than max_chunk_size can make\nthe posted RDMA write read past the chunk\u0027s mapped region. The resulting\nbehaviour depends on the IOMMU configuration: with no IOMMU or in\npassthrough mode the read may extend into memory adjacent to the chunk\nand be returned to the peer, which can disclose host memory; with a\ntranslating IOMMU the out-of-range access is expected to fault and abort\nthe connection. In either case the transfer exceeds what the protocol\npermits and is driven by a remote peer.\n\nReject a descriptor length above max_chunk_size, mirroring the existing\noff \u003e= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients\ndo not exceed it: the client sets desc[0].len to its MR length, which is\ncapped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - RTRS accepts network connections over routable RDMA transports including RoCE and iWARP, and the malicious descriptor is supplied by a remote peer.\nAC:L - The peer directly controls the descriptor length and destination buffer; no race, timing, or victim-controlled state is required in no-IOMMU, passthrough, or software-RDMA deployments.\nPR:N - The handshake validates protocol fields but performs no credential, capability, or authentication check before publishing chunk rkeys and accepting I/O requests.\nUI:N - After connecting, the attacker can submit the crafted RDMA READ request without any victim action.\nS:U - The vulnerable RTRS module and affected host memory remain within the kernel\u0027s security authority; a translating IOMMU prevents rather than permits crossing its isolation boundary.\nC:H - The PD-wide local DMA key does not constrain the attacker-supplied transfer length, permitting a broad out-of-bounds read of adjacent host memory that is returned to the peer.\nI:N - The malformed operation reads server memory and writes it only to the peer\u0027s registered destination; it provides no server-side memory-write primitive.\nA:H - Software-RDMA can CPU-copy through invalid pages and oops or crash, while hardware or IOMMU faults can abort paths. An unauthenticated peer can trigger the condition repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:35.835Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a35b7a8728a53ddc80b323970689fa5985816836"
},
{
"url": "https://git.kernel.org/stable/c/68c09762172f6224e9ddf9b0a60bacbb36e443eb"
},
{
"url": "https://git.kernel.org/stable/c/6cada540150894e81042a0ae0c796a21a9a877da"
},
{
"url": "https://git.kernel.org/stable/c/2912f3d40355dabc08fdbaaf2764d02445fe88dc"
},
{
"url": "https://git.kernel.org/stable/c/6f40246f4312fdbab5a13cc440adebf95eb2aa66"
},
{
"url": "https://git.kernel.org/stable/c/5a45d0aa1fa50a333ce5763ade744e2d89838667"
},
{
"url": "https://git.kernel.org/stable/c/da3e44add94b05dfde56f898421922f5cf35705f"
},
{
"url": "https://git.kernel.org/stable/c/963af8d97a8c6a117134a8d0db1415e0489200b1"
}
],
"title": "RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64269",
"datePublished": "2026-07-25T08:49:16.946Z",
"dateReserved": "2026-07-19T15:36:31.775Z",
"dateUpdated": "2026-08-23T12:45:35.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}