{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:12:47.651Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23066",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:06:27.406913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:25:28.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/recvmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fd3b5e297854a4da0f273169baf4b1b7b257b97",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "c198628f3fca5c874d93874c233014d336e09f64",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "c6cebcb4e0b3140ec2ace45c020a9049527385d1",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "0464bf75590da75b8413c3e758c04647b4cdb3c6",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "cf969bddd6e69c5777fa89dc88402204e72f312a",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "930114425065f7ace6e0c0630fab4af75e059ea8",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "2c28769a51deb6022d7fbd499987e237a01dd63a",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/recvmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recvmsg() unconditional requeue\n\nIf rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at\nthe front of the recvmsg queue already has its mutex locked, it requeues\nthe call - whether or not the call is already queued.  The call may be on\nthe queue because MSG_PEEK was also passed and so the call was not dequeued\nor because the I/O thread requeued it.\n\nThe unconditional requeue may then corrupt the recvmsg queue, leading to\nthings like UAFs or refcount underruns.\n\nFix this by only requeuing the call if it isn\u0027t already on the queue - and\nmoving it to the front if it is already queued.  If we don\u0027t queue it, we\nhave to put the ref we obtained by dequeuing it.\n\nAlso, MSG_PEEK doesn\u0027t dequeue the call so shouldn\u0027t call\nrxrpc_notify_socket() for the call if we didn\u0027t use up all the data on the\nqueue, so fix that also."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered via the recvmsg() syscall on a local AF_RXRPC socket. The attacker must create a local socket and call recvmsg() with specific flags (MSG_DONTWAIT, MSG_PEEK).\nAC:L - The attacker controls both sides of the race condition \u2014 they can have one thread hold the call\u0027s user_mutex while another thread calls recvmsg() with MSG_DONTWAIT, reliably triggering the unconditional requeue and list corruption.\nPR:L - No capability checks exist in rxrpc_create(). Any unprivileged local user can create an AF_RXRPC socket and trigger the bug through recvmsg() with specific flags.\nUI:N - No user interaction is required. The attacker can trigger the vulnerability entirely on their own by opening a socket and calling recvmsg() from multiple threads.\nS:U - The vulnerability affects the kernel within the same security authority. No security boundary (VM, sandbox) is crossed.\nC:H - The use-after-free allows reading freed and potentially reallocated memory, providing arbitrary memory read primitives through heap spraying techniques.\nI:H - The use-after-free and list corruption allow arbitrary write primitives via heap spraying, enabling control flow hijacking and arbitrary code execution in kernel context.\nA:H - List corruption and use-after-free reliably cause kernel crashes (oops/panic), and refcount underruns lead to premature object destruction causing further crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:10.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97"
        },
        {
          "url": "https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a"
        },
        {
          "url": "https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a"
        }
      ],
      "title": "rxrpc: Fix recvmsg() unconditional requeue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23066",
    "datePublished": "2026-02-04T16:07:47.764Z",
    "dateReserved": "2026-01-13T15:37:45.954Z",
    "dateUpdated": "2026-10-19T18:25:28.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23239",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:06:50.245175Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:39.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7ad8b1d0e421c524604d5076b73232093490d5c",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "664e9df53226b4505a0894817ecad2c610ab11d8",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "022ff7f347588de6e17879a1da6019647b21321b",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "e1512c1db9e8794d8d130addd2615ec27231d994",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: Fix race condition in espintcp_close()\n\nThis issue was discovered during a code audit.\n\nAfter cancel_work_sync() is called from espintcp_close(),\nespintcp_tx_work() can still be scheduled from paths such as\nthe Delayed ACK handler or ksoftirqd.\nAs a result, the espintcp_tx_work() worker may dereference a\nfreed espintcp ctx or sk.\n\nThe following is a simple race scenario:\n\n           cpu0                             cpu1\n\n  espintcp_close()\n    cancel_work_sync(\u0026ctx-\u003ework);\n                                     espintcp_write_space()\n                                       schedule_work(\u0026ctx-\u003ework);\n\nTo prevent this race condition, cancel_work_sync() is\nreplaced with disable_work_sync()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must be a local user to create a TCP socket and set the espintcp ULP via setsockopt(TCP_ULP). This cannot be triggered remotely without local socket access.\nAC:L - The attacker controls both sides of the race: they trigger close() and control the remote peer (e.g., localhost connection) to send TCP ACKs that fire write_space, reliably creating the race condition.\nPR:L - No capability checks exist in the TCP_ULP setsockopt path or espintcp_init_sk(). Any unprivileged local user can set up an espintcp ULP socket and trigger this bug.\nUI:N - No user interaction is required; the attacker autonomously creates the socket, sets the ULP, and triggers the race.\nS:U - The vulnerability is a kernel-level use-after-free that does not cross a security boundary such as a VM or sandbox.\nC:H - The use-after-free on espintcp_ctx and sock structures allows an attacker to control freed object contents via heap spraying, enabling arbitrary kernel memory reads.\nI:H - The use-after-free enables heap spraying and arbitrary write primitives through the freed espintcp_ctx and sock structures, allowing potential kernel code execution.\nA:H - The use-after-free causes kernel crashes (oops/panic) when the work function dereferences freed memory, providing reliable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:49.864Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7ad8b1d0e421c524604d5076b73232093490d5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/664e9df53226b4505a0894817ecad2c610ab11d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/022ff7f347588de6e17879a1da6019647b21321b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994"
        }
      ],
      "title": "espintcp: Fix race condition in espintcp_close()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23239",
    "datePublished": "2026-03-10T17:28:26.190Z",
    "dateReserved": "2026-01-13T15:37:45.989Z",
    "dateUpdated": "2026-10-19T18:35:39.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:06:53.340021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:39.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a5de36d6cee74a92c1a21b260bc507e64bc451de",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            },
            {
              "lessThan": "854cd32bc74fe573353095e90958490e4e4d641b",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            },
            {
              "lessThan": "17153f154f80be2b47ebf52840f2d8f724eb2f3b",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            },
            {
              "lessThan": "7bb09315f93dce6acc54bf59e5a95ba7365c2be4",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: Fix race condition in tls_sw_cancel_work_tx()\n\nThis issue was discovered during a code audit.\n\nAfter cancel_delayed_work_sync() is called from tls_sk_proto_close(),\ntx_work_handler() can still be scheduled from paths such as the\nDelayed ACK handler or ksoftirqd.\nAs a result, the tx_work_handler() worker may dereference a freed\nTLS object.\n\nThe following is a simple race scenario:\n\n          cpu0                         cpu1\n\ntls_sk_proto_close()\n  tls_sw_cancel_work_tx()\n                                 tls_write_space()\n                                   tls_sw_write_space()\n                                     if (!test_and_set_bit(BIT_TX_SCHEDULED, \u0026tx_ctx-\u003etx_bitmask))\n    set_bit(BIT_TX_SCHEDULED, \u0026ctx-\u003etx_bitmask);\n    cancel_delayed_work_sync(\u0026ctx-\u003etx_work.work);\n                                     schedule_delayed_work(\u0026tx_ctx-\u003etx_work.work, 0);\n\nTo prevent this race condition, cancel_delayed_work_sync() is\nreplaced with disable_delayed_work_sync()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The tls_write_space callback is triggered by a remote TCP peer sending ACKs, which causes tcp_data_snd_check \u2192 tcp_check_space \u2192 tcp_new_space \u2192 sk-\u003esk_write_space (tls_write_space). Any server using kTLS (nginx, HAProxy, NFS with TLS) is reachable over the network.\nAC:L - The attacker controls both sides of the race: they send TCP ACKs to trigger tls_write_space and initiate disconnect to trigger the close path. With repeated connection attempts and ACK flooding, the race window is reliably winnable.\nPR:N - No authentication or privileges are needed to establish a TCP connection and send ACKs to a kTLS-enabled server. The race is triggered during normal TCP processing before any application-level authentication occurs.\nUI:N - No user interaction is needed. The attacker connects to the server, sends ACKs, and disconnects to trigger the race. The server processes this automatically.\nS:U - The vulnerability results in kernel-level use-after-free within the same security authority (kernel space). There is no crossing of a virtualization or sandbox boundary.\nC:H - This is a use-after-free where the freed tls_sw_context_tx (freed via immediate kfree, not kfree_rcu) can be reallocated with attacker-influenced data. The UAF gives read access to reallocated memory contents, enabling arbitrary kernel memory disclosure.\nI:H - The UAF on the tls_sw_context_tx structure enables heap spraying to control the freed object\u0027s contents. The tx_work_handler then calls tls_tx_records through corrupted context pointers, enabling control flow hijacking and arbitrary code execution.\nA:H - The use-after-free on the embedded delayed_work struct causes kernel crashes when the workqueue attempts to execute the freed work item, resulting in kernel panic or oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:50.947Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a5de36d6cee74a92c1a21b260bc507e64bc451de"
        },
        {
          "url": "https://git.kernel.org/stable/c/854cd32bc74fe573353095e90958490e4e4d641b"
        },
        {
          "url": "https://git.kernel.org/stable/c/17153f154f80be2b47ebf52840f2d8f724eb2f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4"
        }
      ],
      "title": "tls: Fix race condition in tls_sw_cancel_work_tx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23240",
    "datePublished": "2026-03-10T17:28:27.371Z",
    "dateReserved": "2026-01-13T15:37:45.989Z",
    "dateUpdated": "2026-10-19T18:35:39.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:23:09.444431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:47:08.895Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireguard/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfdb22762f903d95c36ab91e9fe6167f22fa9f6d",
              "status": "affected",
              "version": "18e65229a328304a7ef59899a30fd34ad73ed56b",
              "versionType": "git"
            },
            {
              "lessThan": "42bc3f45425b607a5ca7b7aaaab661b54407c8f8",
              "status": "affected",
              "version": "fb978675ccfd4a93549e49624127d8332cc61cbf",
              "versionType": "git"
            },
            {
              "lessThan": "168ee1549fa24fff2ab924a2ca7b1d85f30e062d",
              "status": "affected",
              "version": "8c9e9cd398777fd60ba202211da1110614cb5bc5",
              "versionType": "git"
            },
            {
              "lessThan": "e94b369ff82f9bc84f090f271bd78f41c9f6ab2f",
              "status": "affected",
              "version": "933466fc50a8e4eb167acbd0d8ec96a078462e9c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aba544ff9ec522e120b1b3d8b32efa4e6d16d4d7",
              "versionType": "git"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireguard/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.201",
              "status": "affected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.164",
              "status": "affected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.127",
              "status": "affected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.74",
              "status": "affected",
              "version": "6.12.34",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "5.15.186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "6.1.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "6.6.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "6.12.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"wireguard: device: enable threaded NAPI\"\n\nThis reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is\ncommit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream.\n\nWe have had three independent production user reports in combination\nwith Cilium utilizing WireGuard as encryption underneath that k8s Pod\nE/W traffic to certain peer nodes fully stalled. The situation appears\nas follows:\n\n  - Occurs very rarely but at random times under heavy networking load.\n  - Once the issue triggers the decryption side stops working completely\n    for that WireGuard peer, other peers keep working fine. The stall\n    happens also for newly initiated connections towards that particular\n    WireGuard peer.\n  - Only the decryption side is affected, never the encryption side.\n  - Once it triggers, it never recovers and remains in this state,\n    the CPU/mem on that node looks normal, no leak, busy loop or crash.\n  - bpftrace on the affected system shows that wg_prev_queue_enqueue\n    fails, thus the MAX_QUEUED_PACKETS (1024 skbs!) for the peer\u0027s\n    rx_queue is reached.\n  - Also, bpftrace shows that wg_packet_rx_poll for that peer is never\n    called again after reaching this state for that peer. For other\n    peers wg_packet_rx_poll does get called normally.\n  - Commit db9ae3b (\"wireguard: device: enable threaded NAPI\")\n    switched WireGuard to threaded NAPI by default. The default has\n    not been changed for triggering the issue, neither did CPU\n    hotplugging occur (i.e. 5bd8de2 (\"wireguard: queueing: always\n    return valid online CPU in wg_cpumask_choose_online()\")).\n  - The issue has been observed with stable kernels of v5.15 as well as\n    v6.1. It was reported to us that v5.10 stable is working fine, and\n    no report on v6.6 stable either (somewhat related discussion in [0]\n    though).\n  - In the WireGuard driver the only material difference between v5.10\n    stable and v5.15 stable is the switch to threaded NAPI by default.\n\n    [0] https://lore.kernel.org/netdev/CA+wXwBTT74RErDGAnj98PqS=wvdh8eM1pi4q6tTdExtjnokKqA@mail.gmail.com/\n\nBreakdown of the problem:\n\n  1) skbs arriving for decryption are enqueued to the peer-\u003erx_queue in\n     wg_packet_consume_data via wg_queue_enqueue_per_device_and_peer.\n  2) The latter only moves the skb into the MPSC peer queue if it does\n     not surpass MAX_QUEUED_PACKETS (1024) which is kept track in an\n     atomic counter via wg_prev_queue_enqueue.\n  3) In case enqueueing was successful, the skb is also queued up\n     in the device queue, round-robin picks a next online CPU, and\n     schedules the decryption worker.\n  4) The wg_packet_decrypt_worker, once scheduled, picks these up\n     from the queue, decrypts the packets and once done calls into\n     wg_queue_enqueue_per_peer_rx.\n  5) The latter updates the state to PACKET_STATE_CRYPTED on success\n     and calls napi_schedule on the per peer-\u003enapi instance.\n  6) NAPI then polls via wg_packet_rx_poll. wg_prev_queue_peek checks\n     on the peer-\u003erx_queue. It will wg_prev_queue_dequeue if the\n     queue-\u003epeeked skb was not cached yet, or just return the latter\n     otherwise. (wg_prev_queue_drop_peeked later clears the cache.)\n  7) From an ordering perspective, the peer-\u003erx_queue has skbs in order\n     while the device queue with the per-CPU worker threads from a\n     global ordering PoV can finish the decryption and signal the skb\n     PACKET_STATE_CRYPTED out of order.\n  8) A situation can be observed that the first packet coming in will\n     be stuck waiting for the decryption worker to be scheduled for\n     a longer time when the system is under pressure.\n  9) While this is the case, the other CPUs in the meantime finish\n     decryption and call into napi_schedule.\n 10) Now in wg_packet_rx_poll it picks up the first in-order skb\n     from the peer-\u003erx_queue and sees that its state is still\n     PACKET_STATE_UNCRYPTED. The NAPI poll routine then exits e\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reached by inbound WireGuard UDP data packets processed by the kernel receive path. In severe reasonable deployments such as Kubernetes/Cilium WireGuard encryption, a remote peer/workload can drive this over the network.\nAC:L - The trigger requires high WireGuard receive load and packet/decrypt scheduling interleaving, but the attacker can repeatedly create that load with concurrent network traffic. The race is therefore attacker-influenced rather than dependent on a fixed external condition.\nPR:N - No local privileges on the vulnerable host are required to reach the receive/decrypt/NAPI path. A remote entity able to send traffic through an already configured WireGuard peer can trigger the condition.\nUI:N - No victim user action is required after the WireGuard interface and peer are operating. Network traffic alone drives the vulnerable receive path.\nS:U - The impact remains within the vulnerable kernel/networking security authority. This is not a VM escape, sandbox escape, or cross-scope boundary bypass.\nC:N - The bug is a queue/NAPI forward-progress stall, not a memory disclosure or memory corruption issue. The investigation found no read primitive or leaked data.\nI:N - The affected code stalls per-peer receive processing and drops later packets, but it does not modify attacker-chosen data or corrupt memory. No arbitrary write, control-flow hijack, or data tampering primitive is indicated.\nA:H - Once triggered, decryption for the affected WireGuard peer stops indefinitely and new connections to that peer fail because the receive queue remains full. This can fully deny availability of WireGuard-protected traffic for that peer/node until administrative recovery."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:56.605Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfdb22762f903d95c36ab91e9fe6167f22fa9f6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/42bc3f45425b607a5ca7b7aaaab661b54407c8f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/168ee1549fa24fff2ab924a2ca7b1d85f30e062d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e94b369ff82f9bc84f090f271bd78f41c9f6ab2f"
        }
      ],
      "title": "Revert \"wireguard: device: enable threaded NAPI\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52945",
    "datePublished": "2026-06-24T16:26:03.313Z",
    "dateReserved": "2026-06-09T07:44:35.371Z",
    "dateUpdated": "2026-10-19T19:47:08.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Input/Output Memory Management Unit (IOMMU) subsystem, which manages how devices access system memory. A race condition, a situation where multiple operations occur in an unpredictable order, exists during device recovery when multiple memory domains are being attached concurrently. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been released, potentially allowing a local attacker to execute unauthorized code or cause the system to crash (denial of service)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:45:50.476Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-52952"
          },
          {
            "name": "RHBZ#2492422",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492422"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52952.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fc289e809f3eb7e36cadc4684ab6fad747a5a93",
              "status": "affected",
              "version": "c279e83953d937470f8a6e69b69f62608714f13f",
              "versionType": "git"
            },
            {
              "lessThan": "5474e6e17a262db45c60575c73f70210f5c7001f",
              "status": "affected",
              "version": "c279e83953d937470f8a6e69b69f62608714f13f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset\n\nIn __iommu_group_set_domain_internal(), concurrent domain attachments are\nrejected when any device in the group is recovering. This is necessary to\nfence concurrent attachments to a multi-device group where devices might\nshare the same RID due to PCI DMA alias quirks, but triggers the WARN_ON in\n__iommu_group_set_domain_nofail().\n\nOther IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths, such\nas __iommu_group_set_core_domain and __iommu_release_dma_ownership, should\nnot be rejected, as the domain would be freed anyway in these nofail paths\nwhile group-\u003edomain is still pointing to it. So pci_dev_reset_iommu_done()\ncould trigger a UAF when re-attaching group-\u003edomain.\n\nHonor the IOMMU_SET_DOMAIN_MUST_SUCCEED flag, allowing the callers through\nthe group-\u003erecovery_cnt fence, so as to update the group-\u003edomain pointer.\nInstead add a gdev-\u003eblocked check in the device iteration loop, to prevent\nany concurrent per-device detachment."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable IOMMU recovery path is reached through local PCI/VFIO/IOMMUFD operations such as device reset and domain attach/detach, not by remote packets or physical insertion.\nAC:L - A caller with access to the VFIO/IOMMUFD device can create the reset window and concurrently detach/release the domain; the race window is attacker-influenced and does not depend on rare external conditions.\nPR:L - Exploitation requires local access to an assigned VFIO/IOMMUFD-capable device or equivalent device node permissions, but not necessarily full init-namespace root once the device is delegated.\nUI:N - No victim action is needed after the attacker has the local device access; the attacker can issue the reset and detach operations directly.\nS:C - The stale freed IOMMU domain can affect DMA/IOMMU isolation, allowing impact beyond the attacker\u0027s assigned device/IOMMU context and into host-protected resources.\nC:H - The bug can leave `group-\u003edomain` pointing to a freed IOMMU domain and then reattach through it, a use-after-free that can plausibly be shaped into disclosure of protected host memory.\nI:H - Reusing a freed IOMMU domain during device reattachment can corrupt IOMMU state or subvert DMA mappings, giving a plausible path to arbitrary modification of protected memory.\nA:H - At minimum the stale domain dereference and WARN/UAF path can crash or destabilize the kernel during reset recovery."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:02.035Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fc289e809f3eb7e36cadc4684ab6fad747a5a93"
        },
        {
          "url": "https://git.kernel.org/stable/c/5474e6e17a262db45c60575c73f70210f5c7001f"
        }
      ],
      "title": "iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52952",
    "datePublished": "2026-06-24T16:28:35.247Z",
    "dateReserved": "2026-06-09T07:44:35.372Z",
    "dateUpdated": "2026-08-05T12:32:02.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e",
              "status": "affected",
              "version": "d2ca50606f5f0235d7780c1cd73b6614a5d07620",
              "versionType": "git"
            },
            {
              "lessThan": "a60f25a800846ab8e5a13f8a9d05111f2aee55a7",
              "status": "affected",
              "version": "d2ca50606f5f0235d7780c1cd73b6614a5d07620",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix dead ACL conflict guard in nfsd4_create\n\nnfsd4_create() steals create-\u003ecr_dpacl/cr_pacl into the local\nnfsd_attrs via the designated initializer, then immediately sets the\nsource pointers to NULL. The subsequent conflict guard tests the\nalready-nilled source fields, making it permanently dead code:\n\n    if (create-\u003ecr_acl) {\n        if (create-\u003ecr_dpacl || create-\u003ecr_pacl)  /* always false */\n\nWhen a client encodes both FATTR4_WORD0_ACL and\nFATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr\nbitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without\nreleasing the originals, leaking two posix_acl slab objects per\nrequest. Repeated requests cause unbounded slab exhaustion.\n\nFix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of\nthe nilled create-\u003ecr_dpacl/cr_pacl, matching the correct pattern\nalready used in nfsd4_setattr()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is reached through the in-kernel NFS server (nfsd) processing remotely submitted NFSv4 COMPOUND requests containing OP_CREATE over the network (TCP/2049).\nAC:L - An attacker can reliably trigger the leak by sending CREATE operations with both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_DEFAULT/ACCESS_ACL set in the fattr bitmap; no race or uncontrollable conditions are required.\nPR:N - Exploitation requires only network reachability to nfsd and standard NFSv4 client authentication to an export; no elevated Linux privileges on the server are needed beyond being an authorized NFS client.\nUI:N - The leak is triggered entirely by crafted NFS protocol requests with no action required from a human user on the server.\nS:U - Impact is confined to kernel memory exhaustion on the NFS server; it does not cross a security boundary such as a VM or sandbox escape.\nC:N - The bug causes reference leaks of posix_acl slab objects only; there is no out-of-bounds access, use-after-free, or other memory corruption that could disclose data.\nI:N - No data modification or memory corruption occurs; the only effect is unreleased kernel heap allocations.\nA:H - Each malicious CREATE leaks two posix_acl slab objects, and repeated requests cause unbounded slab exhaustion that can render the NFS server and potentially the entire host unavailable through OOM conditions."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:47.054Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a60f25a800846ab8e5a13f8a9d05111f2aee55a7"
        }
      ],
      "title": "nfsd: fix dead ACL conflict guard in nfsd4_create",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53395",
    "datePublished": "2026-07-19T12:01:57.816Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:47.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:33:13.785456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:17:55.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/key/af_key.c",
            "net/xfrm/xfrm_policy.c",
            "net/xfrm/xfrm_state.c",
            "net/xfrm/xfrm_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "6df8157547347b5257bf640a0ae3dfc4411e06cd",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "fe463798343382c8fe9416a95959f005a3c30aa5",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "00f2c451e57df50b1151d9b2254878f106b7c892",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "a306cf2ac8849c487791369fad6f216399d000f6",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "448bb92ca101dde8a6e88b4dc824044b4e341604",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            },
            {
              "lessThan": "7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4",
              "status": "affected",
              "version": "5c79de6e79cd8ecfbae28886be3ee49044f3a4d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/key/af_key.c",
            "net/xfrm/xfrm_policy.c",
            "net/xfrm/xfrm_state.c",
            "net/xfrm/xfrm_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.21"
            },
            {
              "lessThan": "2.6.21",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.21",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: route MIGRATE notifications to caller\u0027s netns\n\nxfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate()\nin net/key/af_key.c both hardcode \u0026init_net for the multicast that\nannounces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE.\n\nXFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the\nrest of the xfrm/af_key netlink path was made netns-aware in 2008.\nThe other 14 multicast paths in xfrm_user.c route their event using\nxs_net(x), xp_net(xp) or sock_net(skb-\u003esk); only the migrate path\nwas missed.\n\nTwo consequences of the init_net hardcoding:\n\n  1. The notification (selector, old/new endpoint addresses, and the\n     km_address) is delivered to listeners on init_net\u0027s\n     XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on\n     the issuing netns. An IKE daemon running in init_net therefore\n     receives migration notifications originating from any other\n     netns on the host.\n\n  2. An IKE daemon running inside a non-init netns and subscribed\n     to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the\n     notification of its own migration. IKEv2 MOBIKE / address-update\n     handling inside a netns is silently broken.\n\nThread struct net through km_migrate() and the xfrm_mgr.migrate\nfunction pointer, drop the \u0026init_net override in xfrm_send_migrate()\nand pfkey_send_migrate(), and pass the caller\u0027s net (already in\nscope in xfrm_migrate() via sock_net(skb-\u003esk)) all the way down.\nstruct xfrm_mgr is in-tree only and not exported as a stable API,\nso the function-pointer signature change is internal.\n\npfkey_broadcast() is already netns-aware via net_generic(net,\npfkey_net_id) since the pernet conversion. The five other\npfkey_broadcast() callers in af_key.c already pass xs_net(x),\nsock_net(sk) or a per-netns net, so this only removes the\n\u0026init_net outlier."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local NETLINK_XFRM or PF_KEY sockets (xfrm_do_migrate/pfkey_migrate); there is no network packet receive path to xfrm_migrate().\nAC:L - Once IPsec policies and SAs exist (which a CAP_NET_ADMIN caller can create), a successful migrate reliably multicasts the notification; a listener in init_net receives cross-namespace events without winning a race or depending on attacker-uncontrollable state.\nPR:L - Both triggering XFRM_MSG_MIGRATE/SADB_X_MIGRATE and subscribing to XFRMNLGRP_MIGRATE require CAP_NET_ADMIN, which is obtainable in a user namespace (e.g. unshare -U while remaining in init_net) without real root in the init user namespace.\nUI:N - Exploitation requires no victim user action beyond normal background IPsec/MOBIKE operation; the attacker passively listens for migrate notifications.\nS:C - The flaw breaks network-namespace isolation by delivering per-netns IPsec migration notifications to init_net listeners, crossing the security boundary between isolated network namespaces and the host namespace.\nC:H - Successful exploitation discloses sensitive IPsec/MOBIKE data\u2014traffic selectors, old/new tunnel endpoint addresses, and km_address negotiation endpoints\u2014from victim network namespaces to unauthorized init_net listeners.\nI:N - The bug only misroutes multicast notifications; it does not modify kernel memory, IPsec state, or any data beyond the intended migration operation itself.\nA:L - The complementary failure mode silently breaks IKEv2 MOBIKE address-update handling in non-init network namespaces because the issuing namespace never receives its own migration notification, degrading VPN availability without kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:08.336Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad"
        },
        {
          "url": "https://git.kernel.org/stable/c/6df8157547347b5257bf640a0ae3dfc4411e06cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe463798343382c8fe9416a95959f005a3c30aa5"
        },
        {
          "url": "https://git.kernel.org/stable/c/00f2c451e57df50b1151d9b2254878f106b7c892"
        },
        {
          "url": "https://git.kernel.org/stable/c/a306cf2ac8849c487791369fad6f216399d000f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/448bb92ca101dde8a6e88b4dc824044b4e341604"
        },
        {
          "url": "https://git.kernel.org/stable/c/26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4"
        }
      ],
      "title": "xfrm: route MIGRATE notifications to caller\u0027s netns",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63914",
    "datePublished": "2026-07-19T14:55:18.618Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-10-19T20:17:55.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63987",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:34:43.913131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:18:01.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/coalesce.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d4c9cc7c47781c6f4fa29d80a1193a8bcd1525bc",
              "status": "affected",
              "version": "f750dfe825b904164688adeb147950e0e0c4d262",
              "versionType": "git"
            },
            {
              "lessThan": "0c02c190bcd9822477038ff2cee10ea584ac1b1d",
              "status": "affected",
              "version": "f750dfe825b904164688adeb147950e0e0c4d262",
              "versionType": "git"
            },
            {
              "lessThan": "6205f7166d2dd14a017a5802c81e5bd1421a8635",
              "status": "affected",
              "version": "f750dfe825b904164688adeb147950e0e0c4d262",
              "versionType": "git"
            },
            {
              "lessThan": "7281b096b072f6c6e30420e3467d738f2e4c4b57",
              "status": "affected",
              "version": "f750dfe825b904164688adeb147950e0e0c4d262",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/coalesce.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES\n\nethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION\nnest list with an index \u0027i\u0027 and writes new_profile[i++] without\nbounding i. The destination is kmemdup()\u0027d at NET_DIM_PARAMS_NUM_PROFILES\nentries (5), but the Netlink nest count is entirely user-controlled.\nNetlink policies do not have support for constraining the number\nof nested entries (or number of multi-attr entries)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the ETHTOOL_MSG_COALESCE_SET generic-netlink ioctl path (ethnl_default_set_doit \u2192 ethnl_set_coalesce \u2192 ethnl_update_profile), not via remote network packets or physical bus access.\nAC:L - An attacker with CAP_NET_ADMIN can send a crafted netlink message with more than five nested ETHTOOL_A_PROFILE_IRQ_MODERATION attributes and deterministically trigger a heap buffer overflow past the five-entry kmemdup buffer.\nPR:L - ETHTOOL_MSG_COALESCE_SET is gated by GENL_UNS_ADMIN_PERM, which requires CAP_NET_ADMIN in the socket\u0027s network namespace user namespace; this capability is obtainable by an unprivileged user via user namespaces (unshare -Urn) or containers granted NET_ADMIN (e.g., hostNetwork pods).\nUI:N - Exploitation requires only the attacker\u0027s own ethtool netlink SET_COALESCE request with a malformed profile nest; no action by another user or victim is needed.\nS:U - The vulnerability corrupts kernel heap memory within the same kernel security domain; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security authority.\nC:H - The out-of-bounds writes past the 120-byte (5 \u00d7 24-byte dim_cq_moder) kmalloc allocation can corrupt adjacent slab objects, providing a standard heap-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The attacker fully controls the overflowed u16 profile fields (usec, pkts, comps) written beyond the allocation boundary, enabling heap metadata or adjacent-object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap corruption from unbounded profile indexing can cause immediate kernel oops/panic during the write or when the corrupted profile is subsequently used by DIM/virtio-net interrupt moderation paths."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:54.593Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d4c9cc7c47781c6f4fa29d80a1193a8bcd1525bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c02c190bcd9822477038ff2cee10ea584ac1b1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6205f7166d2dd14a017a5802c81e5bd1421a8635"
        },
        {
          "url": "https://git.kernel.org/stable/c/7281b096b072f6c6e30420e3467d738f2e4c4b57"
        }
      ],
      "title": "ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63987",
    "datePublished": "2026-07-19T14:56:08.940Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-10-19T20:18:01.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}