CVE-2025-68358 (GCVE-0-2025-68358)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:32 – Updated: 2026-05-11 21:51
VLAI
Title
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() From the memory-barriers.txt document regarding memory barrier ordering guarantees: (*) These guarantees do not apply to bitfields, because compilers often generate code to modify these using non-atomic read-modify-write sequences. Do not attempt to use bitfields to synchronize parallel algorithms. (*) Even in cases where bitfields are protected by locks, all fields in a given bitfield must be protected by one lock. If two fields in a given bitfield are protected by different locks, the compiler's non-atomic read-modify-write sequences can cause an update to one field to corrupt the value of an adjacent field. btrfs_space_info has a bitfield sharing an underlying word consisting of the fields full, chunk_alloc, and flush: struct btrfs_space_info { struct btrfs_fs_info * fs_info; /* 0 8 */ struct btrfs_space_info * parent; /* 8 8 */ ... int clamp; /* 172 4 */ unsigned int full:1; /* 176: 0 4 */ unsigned int chunk_alloc:1; /* 176: 1 4 */ unsigned int flush:1; /* 176: 2 4 */ ... Therefore, to be safe from parallel read-modify-writes losing a write to one of the bitfield members protected by a lock, all writes to all the bitfields must use the lock. They almost universally do, except for btrfs_clear_space_info_full() which iterates over the space_infos and writes out found->full = 0 without a lock. Imagine that we have one thread completing a transaction in which we finished deleting a block_group and are thus calling btrfs_clear_space_info_full() while simultaneously the data reclaim ticket infrastructure is running do_async_reclaim_data_space(): T1 T2 btrfs_commit_transaction btrfs_clear_space_info_full data_sinfo->full = 0 READ: full:0, chunk_alloc:0, flush:1 do_async_reclaim_data_space(data_sinfo) spin_lock(&space_info->lock); if(list_empty(tickets)) space_info->flush = 0; READ: full: 0, chunk_alloc:0, flush:1 MOD/WRITE: full: 0, chunk_alloc:0, flush:0 spin_unlock(&space_info->lock); return; MOD/WRITE: full:0, chunk_alloc:0, flush:1 and now data_sinfo->flush is 1 but the reclaim worker has exited. This breaks the invariant that flush is 0 iff there is no work queued or running. Once this invariant is violated, future allocations that go into __reserve_bytes() will add tickets to space_info->tickets but will see space_info->flush is set to 1 and not queue the work. After this, they will block forever on the resulting ticket, as it is now impossible to kick the worker again. I also confirmed by looking at the assembly of the affected kernel that it is doing RMW operations. For example, to set the flush (3rd) bit to 0, the assembly is: andb $0xfb,0x60(%rbx) and similarly for setting the full (1st) bit to 0: andb $0xfe,-0x20(%rax) So I think this is really a bug on practical systems. I have observed a number of systems in this exact state, but am currently unable to reproduce it. Rather than leaving this footgun lying around for the future, take advantage of the fact that there is room in the struct anyway, and that it is already quite large and simply change the three bitfield members to bools. This avoids writes to space_info->full having any effect on ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 957780eb2788d8c218d539e19a85653f51a96dc1 , < b0bb67385480a3aa4c54b139e4f371ddd06b5150 (git)
Affected: 957780eb2788d8c218d539e19a85653f51a96dc1 , < 55835646da78e83e7ad06abd741ca8fd8c0b0ea7 (git)
Affected: 957780eb2788d8c218d539e19a85653f51a96dc1 , < d4a81b8ec639895999275ea2472c69825cd67ea4 (git)
Affected: 957780eb2788d8c218d539e19a85653f51a96dc1 , < db4ae18e1b31e0421fb5312e56aefa382bbc6ece (git)
Affected: 957780eb2788d8c218d539e19a85653f51a96dc1 , < 6f442808a86eef847ee10afa9e6459494ed85bb3 (git)
Affected: 957780eb2788d8c218d539e19a85653f51a96dc1 , < 742b90eaf394f0018352c0e10dc89763b2dd5267 (git)
Affected: 957780eb2788d8c218d539e19a85653f51a96dc1 , < 38e818718c5e04961eea0fa8feff3f100ce40408 (git)
Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.15.201 , ≤ 5.15.* (semver)
Unaffected: 6.1.164 , ≤ 6.1.* (semver)
Unaffected: 6.6.124 , ≤ 6.6.* (semver)
Unaffected: 6.12.68 , ≤ 6.12.* (semver)
Unaffected: 6.17.13 , ≤ 6.17.* (semver)
Unaffected: 6.18.2 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/block-group.c",
            "fs/btrfs/space-info.c",
            "fs/btrfs/space-info.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b0bb67385480a3aa4c54b139e4f371ddd06b5150",
              "status": "affected",
              "version": "957780eb2788d8c218d539e19a85653f51a96dc1",
              "versionType": "git"
            },
            {
              "lessThan": "55835646da78e83e7ad06abd741ca8fd8c0b0ea7",
              "status": "affected",
              "version": "957780eb2788d8c218d539e19a85653f51a96dc1",
              "versionType": "git"
            },
            {
              "lessThan": "d4a81b8ec639895999275ea2472c69825cd67ea4",
              "status": "affected",
              "version": "957780eb2788d8c218d539e19a85653f51a96dc1",
              "versionType": "git"
            },
            {
              "lessThan": "db4ae18e1b31e0421fb5312e56aefa382bbc6ece",
              "status": "affected",
              "version": "957780eb2788d8c218d539e19a85653f51a96dc1",
              "versionType": "git"
            },
            {
              "lessThan": "6f442808a86eef847ee10afa9e6459494ed85bb3",
              "status": "affected",
              "version": "957780eb2788d8c218d539e19a85653f51a96dc1",
              "versionType": "git"
            },
            {
              "lessThan": "742b90eaf394f0018352c0e10dc89763b2dd5267",
              "status": "affected",
              "version": "957780eb2788d8c218d539e19a85653f51a96dc1",
              "versionType": "git"
            },
            {
              "lessThan": "38e818718c5e04961eea0fa8feff3f100ce40408",
              "status": "affected",
              "version": "957780eb2788d8c218d539e19a85653f51a96dc1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/block-group.c",
            "fs/btrfs/space-info.c",
            "fs/btrfs/space-info.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix racy bitfield write in btrfs_clear_space_info_full()\n\nFrom the memory-barriers.txt document regarding memory barrier ordering\nguarantees:\n\n (*) These guarantees do not apply to bitfields, because compilers often\n     generate code to modify these using non-atomic read-modify-write\n     sequences.  Do not attempt to use bitfields to synchronize parallel\n     algorithms.\n\n (*) Even in cases where bitfields are protected by locks, all fields\n     in a given bitfield must be protected by one lock.  If two fields\n     in a given bitfield are protected by different locks, the compiler\u0027s\n     non-atomic read-modify-write sequences can cause an update to one\n     field to corrupt the value of an adjacent field.\n\nbtrfs_space_info has a bitfield sharing an underlying word consisting of\nthe fields full, chunk_alloc, and flush:\n\nstruct btrfs_space_info {\n        struct btrfs_fs_info *     fs_info;              /*     0     8 */\n        struct btrfs_space_info *  parent;               /*     8     8 */\n        ...\n        int                        clamp;                /*   172     4 */\n        unsigned int               full:1;               /*   176: 0  4 */\n        unsigned int               chunk_alloc:1;        /*   176: 1  4 */\n        unsigned int               flush:1;              /*   176: 2  4 */\n        ...\n\nTherefore, to be safe from parallel read-modify-writes losing a write to\none of the bitfield members protected by a lock, all writes to all the\nbitfields must use the lock. They almost universally do, except for\nbtrfs_clear_space_info_full() which iterates over the space_infos and\nwrites out found-\u003efull = 0 without a lock.\n\nImagine that we have one thread completing a transaction in which we\nfinished deleting a block_group and are thus calling\nbtrfs_clear_space_info_full() while simultaneously the data reclaim\nticket infrastructure is running do_async_reclaim_data_space():\n\n          T1                                             T2\nbtrfs_commit_transaction\n  btrfs_clear_space_info_full\n  data_sinfo-\u003efull = 0\n  READ: full:0, chunk_alloc:0, flush:1\n                                              do_async_reclaim_data_space(data_sinfo)\n                                              spin_lock(\u0026space_info-\u003elock);\n                                              if(list_empty(tickets))\n                                                space_info-\u003eflush = 0;\n                                                READ: full: 0, chunk_alloc:0, flush:1\n                                                MOD/WRITE: full: 0, chunk_alloc:0, flush:0\n                                                spin_unlock(\u0026space_info-\u003elock);\n                                                return;\n  MOD/WRITE: full:0, chunk_alloc:0, flush:1\n\nand now data_sinfo-\u003eflush is 1 but the reclaim worker has exited. This\nbreaks the invariant that flush is 0 iff there is no work queued or\nrunning. Once this invariant is violated, future allocations that go\ninto __reserve_bytes() will add tickets to space_info-\u003etickets but will\nsee space_info-\u003eflush is set to 1 and not queue the work. After this,\nthey will block forever on the resulting ticket, as it is now impossible\nto kick the worker again.\n\nI also confirmed by looking at the assembly of the affected kernel that\nit is doing RMW operations. For example, to set the flush (3rd) bit to 0,\nthe assembly is:\n  andb    $0xfb,0x60(%rbx)\nand similarly for setting the full (1st) bit to 0:\n  andb    $0xfe,-0x20(%rax)\n\nSo I think this is really a bug on practical systems.  I have observed\na number of systems in this exact state, but am currently unable to\nreproduce it.\n\nRather than leaving this footgun lying around for the future, take\nadvantage of the fact that there is room in the struct anyway, and that\nit is already quite large and simply change the three bitfield members to\nbools. This avoids writes to space_info-\u003efull having any effect on\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:51:39.547Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b0bb67385480a3aa4c54b139e4f371ddd06b5150"
        },
        {
          "url": "https://git.kernel.org/stable/c/55835646da78e83e7ad06abd741ca8fd8c0b0ea7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4a81b8ec639895999275ea2472c69825cd67ea4"
        },
        {
          "url": "https://git.kernel.org/stable/c/db4ae18e1b31e0421fb5312e56aefa382bbc6ece"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f442808a86eef847ee10afa9e6459494ed85bb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/742b90eaf394f0018352c0e10dc89763b2dd5267"
        },
        {
          "url": "https://git.kernel.org/stable/c/38e818718c5e04961eea0fa8feff3f100ce40408"
        }
      ],
      "title": "btrfs: fix racy bitfield write in btrfs_clear_space_info_full()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68358",
    "datePublished": "2025-12-24T10:32:47.692Z",
    "dateReserved": "2025-12-16T14:48:05.305Z",
    "dateUpdated": "2026-05-11T21:51:39.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68358",
      "date": "2026-07-03",
      "epss": "0.00161",
      "percentile": "0.05636"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68358\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:59.173\",\"lastModified\":\"2026-06-17T09:58:59.683\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix racy bitfield write in btrfs_clear_space_info_full()\\n\\nFrom the memory-barriers.txt document regarding memory barrier ordering\\nguarantees:\\n\\n (*) These guarantees do not apply to bitfields, because compilers often\\n     generate code to modify these using non-atomic read-modify-write\\n     sequences.  Do not attempt to use bitfields to synchronize parallel\\n     algorithms.\\n\\n (*) Even in cases where bitfields are protected by locks, all fields\\n     in a given bitfield must be protected by one lock.  If two fields\\n     in a given bitfield are protected by different locks, the compiler\u0027s\\n     non-atomic read-modify-write sequences can cause an update to one\\n     field to corrupt the value of an adjacent field.\\n\\nbtrfs_space_info has a bitfield sharing an underlying word consisting of\\nthe fields full, chunk_alloc, and flush:\\n\\nstruct btrfs_space_info {\\n        struct btrfs_fs_info *     fs_info;              /*     0     8 */\\n        struct btrfs_space_info *  parent;               /*     8     8 */\\n        ...\\n        int                        clamp;                /*   172     4 */\\n        unsigned int               full:1;               /*   176: 0  4 */\\n        unsigned int               chunk_alloc:1;        /*   176: 1  4 */\\n        unsigned int               flush:1;              /*   176: 2  4 */\\n        ...\\n\\nTherefore, to be safe from parallel read-modify-writes losing a write to\\none of the bitfield members protected by a lock, all writes to all the\\nbitfields must use the lock. They almost universally do, except for\\nbtrfs_clear_space_info_full() which iterates over the space_infos and\\nwrites out found-\u003efull = 0 without a lock.\\n\\nImagine that we have one thread completing a transaction in which we\\nfinished deleting a block_group and are thus calling\\nbtrfs_clear_space_info_full() while simultaneously the data reclaim\\nticket infrastructure is running do_async_reclaim_data_space():\\n\\n          T1                                             T2\\nbtrfs_commit_transaction\\n  btrfs_clear_space_info_full\\n  data_sinfo-\u003efull = 0\\n  READ: full:0, chunk_alloc:0, flush:1\\n                                              do_async_reclaim_data_space(data_sinfo)\\n                                              spin_lock(\u0026space_info-\u003elock);\\n                                              if(list_empty(tickets))\\n                                                space_info-\u003eflush = 0;\\n                                                READ: full: 0, chunk_alloc:0, flush:1\\n                                                MOD/WRITE: full: 0, chunk_alloc:0, flush:0\\n                                                spin_unlock(\u0026space_info-\u003elock);\\n                                                return;\\n  MOD/WRITE: full:0, chunk_alloc:0, flush:1\\n\\nand now data_sinfo-\u003eflush is 1 but the reclaim worker has exited. This\\nbreaks the invariant that flush is 0 iff there is no work queued or\\nrunning. Once this invariant is violated, future allocations that go\\ninto __reserve_bytes() will add tickets to space_info-\u003etickets but will\\nsee space_info-\u003eflush is set to 1 and not queue the work. After this,\\nthey will block forever on the resulting ticket, as it is now impossible\\nto kick the worker again.\\n\\nI also confirmed by looking at the assembly of the affected kernel that\\nit is doing RMW operations. For example, to set the flush (3rd) bit to 0,\\nthe assembly is:\\n  andb    $0xfb,0x60(%rbx)\\nand similarly for setting the full (1st) bit to 0:\\n  andb    $0xfe,-0x20(%rax)\\n\\nSo I think this is really a bug on practical systems.  I have observed\\na number of systems in this exact state, but am currently unable to\\nreproduce it.\\n\\nRather than leaving this footgun lying around for the future, take\\nadvantage of the fact that there is room in the struct anyway, and that\\nit is already quite large and simply change the three bitfield members to\\nbools. This avoids writes to space_info-\u003efull having any effect on\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/block-group.c\",\"fs/btrfs/space-info.c\",\"fs/btrfs/space-info.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"957780eb2788d8c218d539e19a85653f51a96dc1\",\"lessThan\":\"b0bb67385480a3aa4c54b139e4f371ddd06b5150\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"957780eb2788d8c218d539e19a85653f51a96dc1\",\"lessThan\":\"55835646da78e83e7ad06abd741ca8fd8c0b0ea7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"957780eb2788d8c218d539e19a85653f51a96dc1\",\"lessThan\":\"d4a81b8ec639895999275ea2472c69825cd67ea4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"957780eb2788d8c218d539e19a85653f51a96dc1\",\"lessThan\":\"db4ae18e1b31e0421fb5312e56aefa382bbc6ece\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"957780eb2788d8c218d539e19a85653f51a96dc1\",\"lessThan\":\"6f442808a86eef847ee10afa9e6459494ed85bb3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"957780eb2788d8c218d539e19a85653f51a96dc1\",\"lessThan\":\"742b90eaf394f0018352c0e10dc89763b2dd5267\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"957780eb2788d8c218d539e19a85653f51a96dc1\",\"lessThan\":\"38e818718c5e04961eea0fa8feff3f100ce40408\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/block-group.c\",\"fs/btrfs/space-info.c\",\"fs/btrfs/space-info.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.201\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.164\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.124\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.68\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.13\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.2\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.8\",\"versionEndExcluding\":\"5.15.201\",\"matchCriteriaId\":\"71AEF3CC-CAEF-426A-B123-772DC8D84A0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.164\",\"matchCriteriaId\":\"6892F74B-3F14-4500-9652-24A2ECB04144\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.124\",\"matchCriteriaId\":\"76183B9F-CABE-4E21-A3E3-F0EBF99DC3C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.68\",\"matchCriteriaId\":\"52F38E19-0FDD-4992-9D6D-D4169D689598\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.17.13\",\"matchCriteriaId\":\"8E97BE39-8D15-4D59-822A-602B5F5A990B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.2\",\"matchCriteriaId\":\"5ACE912B-1ACA-466A-BB6D-22DF82E58988\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38e818718c5e04961eea0fa8feff3f100ce40408\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55835646da78e83e7ad06abd741ca8fd8c0b0ea7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f442808a86eef847ee10afa9e6459494ed85bb3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/742b90eaf394f0018352c0e10dc89763b2dd5267\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0bb67385480a3aa4c54b139e4f371ddd06b5150\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d4a81b8ec639895999275ea2472c69825cd67ea4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/db4ae18e1b31e0421fb5312e56aefa382bbc6ece\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.