{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:54:42.821Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kernel/perf_cpum_sf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "238e3af849dfdcb1faed544349f7025e533f9aab",
              "status": "affected",
              "version": "e3d617fe6ac7294974fc513dc5e4d8ada8080fd1",
              "versionType": "git"
            },
            {
              "lessThan": "99192c735ed4bfdff0d215ec85c8a87a677cb898",
              "status": "affected",
              "version": "e3d617fe6ac7294974fc513dc5e4d8ada8080fd1",
              "versionType": "git"
            },
            {
              "lessThan": "06a92f810df8037ca36157282ddcbefdcaf049b8",
              "status": "affected",
              "version": "e3d617fe6ac7294974fc513dc5e4d8ada8080fd1",
              "versionType": "git"
            },
            {
              "lessThan": "b5be6a0bb639d165c8418d8dddd8f322587be8be",
              "status": "affected",
              "version": "e3d617fe6ac7294974fc513dc5e4d8ada8080fd1",
              "versionType": "git"
            },
            {
              "lessThan": "a69752f1e5de817941a2ea0609254f6f25acd274",
              "status": "affected",
              "version": "e3d617fe6ac7294974fc513dc5e4d8ada8080fd1",
              "versionType": "git"
            },
            {
              "lessThan": "be54e6e0f93a39a9c00478d70d12956a5f3d5b9b",
              "status": "affected",
              "version": "e3d617fe6ac7294974fc513dc5e4d8ada8080fd1",
              "versionType": "git"
            },
            {
              "lessThan": "a0bd7dacbd51c632b8e2c0500b479af564afadf3",
              "status": "affected",
              "version": "e3d617fe6ac7294974fc513dc5e4d8ada8080fd1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/kernel/perf_cpum_sf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cpum_sf: Handle CPU hotplug remove during sampling\n\nCPU hotplug remove handling triggers the following function\ncall sequence:\n\n   CPUHP_AP_PERF_S390_SF_ONLINE  --\u003e s390_pmu_sf_offline_cpu()\n   ...\n   CPUHP_AP_PERF_ONLINE          --\u003e perf_event_exit_cpu()\n\nThe s390 CPUMF sampling CPU hotplug handler invokes:\n\n s390_pmu_sf_offline_cpu()\n +--\u003e  cpusf_pmu_setup()\n       +--\u003e setup_pmc_cpu()\n            +--\u003e deallocate_buffers()\n\nThis function de-allocates all sampling data buffers (SDBs) allocated\nfor that CPU at event initialization. It also clears the\nPMU_F_RESERVED bit. The CPU is gone and can not be sampled.\n\nWith the event still being active on the removed CPU, the CPU event\nhotplug support in kernel performance subsystem triggers the\nfollowing function calls on the removed CPU:\n\n  perf_event_exit_cpu()\n  +--\u003e perf_event_exit_cpu_context()\n       +--\u003e __perf_event_exit_context()\n\t    +--\u003e __perf_remove_from_context()\n\t         +--\u003e event_sched_out()\n\t              +--\u003e cpumsf_pmu_del()\n\t                   +--\u003e cpumsf_pmu_stop()\n                                +--\u003e hw_perf_event_update()\n\nto stop and remove the event. During removal of the event, the\nsampling device driver tries to read out the remaining samples from\nthe sample data buffers (SDBs). But they have already been freed\n(and may have been re-assigned). This may lead to a use after free\nsituation in which case the samples are most likely invalid. In the\nbest case the memory has not been reassigned and still contains\nvalid data.\n\nRemedy this situation and check if the CPU is still in reserved\nstate (bit PMU_F_RESERVED set). In this case the SDBs have not been\nreleased an contain valid data. This is always the case when\nthe event is removed (and no CPU hotplug off occured).\nIf the PMU_F_RESERVED bit is not set, the SDB buffers are gone."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the local `perf_event_open()` syscall establishing a CPUM_SF sampling event combined with a CPU hot-unplug of that CPU; no network or adjacent-network path exists.\nAC:L - The attacker keeps a per-CPU sampling event installed indefinitely so any CPU-offline transition deterministically hits the freed SDBs, and on Linux on Z the offline side is attacker-influenceable (cpuplugd unplugs CPUs based on load the attacker generates) or directly performed, making the trigger repeatable rather than a narrow race.\nPR:L - A local unprivileged account suffices to hold the CPUM_SF sampling session on systems where perf_event_paranoid is relaxed \u2014 the standard configuration on IBM Z hosts that use CPUMF sampling for profiling \u2014 while the CPU-offline transition is supplied by the routinely-active cpuplugd daemon or hypervisor CPU reconfiguration rather than by the attacker\u0027s own privileges.\nUI:N - No victim action is required; the sampling event and the CPU hotplug transition are system/administrative operations, not interactions of a targeted user with attacker-supplied content.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `hw_collect_samples()` reads `hws_basic_entry` records out of freed and reallocated pages and pushes them to userspace through `perf_push_sample()`, leaking arbitrary reused kernel memory into the attacker-readable perf ring buffer, with the target address taken from a freed-page value fed to `phys_to_virt()`.\nI:H - The stale walk writes into freed/reallocated memory via `sample-\u003edef = 0` and `cmpxchg128(\u0026te-\u003eheader.val, ...)`, at addresses derived from freed-page contents, giving a memory-corruption primitive usable against arbitrary reallocated kernel objects.\nA:H - Dereferencing a bogus physical address obtained from freed memory, plus corruption of pages already reassigned to other kernel users, reliably produces a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:40.129Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/238e3af849dfdcb1faed544349f7025e533f9aab"
        },
        {
          "url": "https://git.kernel.org/stable/c/99192c735ed4bfdff0d215ec85c8a87a677cb898"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a92f810df8037ca36157282ddcbefdcaf049b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5be6a0bb639d165c8418d8dddd8f322587be8be"
        },
        {
          "url": "https://git.kernel.org/stable/c/a69752f1e5de817941a2ea0609254f6f25acd274"
        },
        {
          "url": "https://git.kernel.org/stable/c/be54e6e0f93a39a9c00478d70d12956a5f3d5b9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0bd7dacbd51c632b8e2c0500b479af564afadf3"
        }
      ],
      "title": "s390/cpum_sf: Handle CPU hotplug remove during sampling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57849",
    "datePublished": "2025-01-11T14:30:58.365Z",
    "dateReserved": "2025-01-11T12:33:33.699Z",
    "dateUpdated": "2026-08-05T11:46:40.129Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:13.928914Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:20.820Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/smsc/smc91x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1c4cb705e733250d13243f6a69b8b5a92e39b9f6",
              "status": "affected",
              "version": "342a93247e0837101f27bbcca26f402902df98dc",
              "versionType": "git"
            },
            {
              "lessThan": "9d222141b00156509d67d80c771fbefa92c43ace",
              "status": "affected",
              "version": "342a93247e0837101f27bbcca26f402902df98dc",
              "versionType": "git"
            },
            {
              "lessThan": "ef277ae121b3249c99994652210a326b52d527b0",
              "status": "affected",
              "version": "342a93247e0837101f27bbcca26f402902df98dc",
              "versionType": "git"
            },
            {
              "lessThan": "36561b86cb2501647662cfaf91286dd6973804a6",
              "status": "affected",
              "version": "342a93247e0837101f27bbcca26f402902df98dc",
              "versionType": "git"
            },
            {
              "lessThan": "b6018d5c1a8f09d5efe4d6961d7ee45fdf3a7ce3",
              "status": "affected",
              "version": "342a93247e0837101f27bbcca26f402902df98dc",
              "versionType": "git"
            },
            {
              "lessThan": "6402078bd9d1ed46e79465e1faaa42e3458f8a33",
              "status": "affected",
              "version": "342a93247e0837101f27bbcca26f402902df98dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/smsc/smc91x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmc91x: fix broken irq-context in PREEMPT_RT\n\nWhen smc91x.c is built with PREEMPT_RT, the following splat occurs\nin FVP_RevC:\n\n[   13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000\n[   13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106]\n[   13.062137]      preempt=0x00000000 lock=0-\u003e0 RCU=0-\u003e1 workfn=mld_ifc_work\n[   13.062266] C\n** replaying previous printk message **\n[   13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)}\n[   13.062353] Hardware name:  , BIOS\n[   13.062382] Workqueue: mld mld_ifc_work\n[   13.062469] Call trace:\n[   13.062494]  show_stack+0x24/0x40 (C)\n[   13.062602]  __dump_stack+0x28/0x48\n[   13.062710]  dump_stack_lvl+0x7c/0xb0\n[   13.062818]  dump_stack+0x18/0x34\n[   13.062926]  process_scheduled_works+0x294/0x450\n[   13.063043]  worker_thread+0x260/0x3d8\n[   13.063124]  kthread+0x1c4/0x228\n[   13.063235]  ret_from_fork+0x10/0x20\n\nThis happens because smc_special_trylock() disables IRQs even on PREEMPT_RT,\nbut smc_special_unlock() does not restore IRQs on PREEMPT_RT.\nThe reason is that smc_special_unlock() calls spin_unlock_irqrestore(),\nand rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke\nrcu_read_unlock() through __local_bh_enable_ip() when current-\u003esoftirq_disable_cnt becomes zero.\n\nTo address this issue, replace smc_special_trylock() with spin_trylock_irqsave()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Internet-routable ICMP/TCP traffic can force transmission through smc91x, while a pre-authentication network service makes the persistent process-context RCU leak remotely repeatable. An adjacent MLD query also directly schedules report work that reaches the vulnerable path.\nAC:L - On an affected SMP PREEMPT_RT system, every successful transmit-side trylock produces the IRQ-state mismatch without a race or uncontrolled timing requirement. Required packet fields and repeated transmissions are attacker-controlled.\nPR:N - Unauthenticated network traffic reaches the transmit path without target credentials or capabilities. The MLD path likewise has protocol-validity checks but no authentication or privilege check.\nUI:N - Kernel protocol handling and network-service responses occur automatically without victim action.\nS:U - The IRQ and RCU corruption affects the same host kernel security authority and does not cross a VM, IOMMU, or other security boundary.\nC:N - The bug leaks RCU read-side state and disables interrupts but provides no memory disclosure or read primitive.\nI:N - No memory is corrupted and no attacker-controlled write or data-modification primitive is created.\nA:H - Leaked RCU nesting can indefinitely block grace periods and accumulate callbacks, while broken IRQ state can stall critical processing. Repeated triggering can therefore cause RCU stalls or a system-wide hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:17.694Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1c4cb705e733250d13243f6a69b8b5a92e39b9f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d222141b00156509d67d80c771fbefa92c43ace"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef277ae121b3249c99994652210a326b52d527b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/36561b86cb2501647662cfaf91286dd6973804a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6018d5c1a8f09d5efe4d6961d7ee45fdf3a7ce3"
        },
        {
          "url": "https://git.kernel.org/stable/c/6402078bd9d1ed46e79465e1faaa42e3458f8a33"
        }
      ],
      "title": "smc91x: fix broken irq-context in PREEMPT_RT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71132",
    "datePublished": "2026-01-14T15:07:47.860Z",
    "dateReserved": "2026-01-13T15:30:19.655Z",
    "dateUpdated": "2026-08-05T12:12:17.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            },
            {
              "lessThan": "de7c097800f07f3c108185c7a38b53a530ba30ff",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            },
            {
              "lessThan": "db5435b5342e3aaa4521d0f3ccfe94316b253ca1",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            },
            {
              "lessThan": "f94a0de7b9f32745a14a1621c63087a092823587",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            },
            {
              "lessThan": "c65cdf46ce340c9c00fbbaf84599d2daff43626e",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            },
            {
              "lessThan": "fef13c403be3fb685cb06419e6b3623106aab5ba",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            },
            {
              "lessThan": "d31065526f160ee0244a719230aa069daca2bf4d",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            },
            {
              "lessThan": "e6834a4c474697df23ab9948fd3577b26bf48656",
              "status": "affected",
              "version": "3aba891dde3842d89ad022237b99c1ed308040b0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix UAF in rlb_arp_recv during bond up/down\n\nThe ALB RX path may access rx_hashtbl concurrently with bond\nteardown. During rapid bond up/down cycles, rlb_deinitialize()\nfrees rx_hashtbl while RX handlers are still running, leading\nto a null pointer dereference detected by KASAN.\n\nHowever, the root cause is that rlb_arp_recv() can still be accessed\nafter setting recv_probe to NULL, which is actually a use-after-free\n(UAF) issue. That is the reason for using the referenced commit in the\nFixes tag.\n\n[  214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI\n[  214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n[  214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary)\n[  214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022\n[  214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding]\n[  214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6\n 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00\n[  214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206\n[  214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e\n[  214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8\n[  214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8\n[  214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119\n[  214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810\n[  214.286943] FS:  00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000\n[  214.295966] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0\n[  214.310347] Call Trace:\n[  214.313070]  \u003cIRQ\u003e\n[  214.315318]  ? __pfx_rlb_arp_recv+0x10/0x10 [bonding]\n[  214.320975]  bond_handle_frame+0x166/0xb60 [bonding]\n[  214.326537]  ? __pfx_bond_handle_frame+0x10/0x10 [bonding]\n[  214.332680]  __netif_receive_skb_core.constprop.0+0x576/0x2710\n[  214.339199]  ? __pfx_arp_process+0x10/0x10\n[  214.343775]  ? sched_balance_find_src_group+0x98/0x630\n[  214.349513]  ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10\n[  214.356513]  ? arp_rcv+0x307/0x690\n[  214.360311]  ? __pfx_arp_rcv+0x10/0x10\n[  214.364499]  ? __lock_acquire+0x58c/0xbd0\n[  214.368975]  __netif_receive_skb_one_core+0xae/0x1b0\n[  214.374518]  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n[  214.380743]  ? lock_acquire+0x10b/0x140\n[  214.385026]  process_backlog+0x3f1/0x13a0\n[  214.389502]  ? process_backlog+0x3aa/0x13a0\n[  214.394174]  __napi_poll.constprop.0+0x9f/0x370\n[  214.399233]  net_rx_action+0x8c1/0xe60\n[  214.403423]  ? __pfx_net_rx_action+0x10/0x10\n[  214.408193]  ? lock_acquire.part.0+0xbd/0x260\n[  214.413058]  ? sched_clock_cpu+0x6c/0x540\n[  214.417540]  ? mark_held_locks+0x40/0x70\n[  214.421920]  handle_softirqs+0x1fd/0x860\n[  214.426302]  ? __pfx_handle_softirqs+0x10/0x10\n[  214.431264]  ? __neigh_event_send+0x2d6/0xf50\n[  214.436131]  do_softirq+0xb1/0xf0\n[  214.439830]  \u003c/IRQ\u003e\n\nThe issue is reproducible by repeatedly running\nip link set bond0 up/down while receiving ARP messages, where\nrlb_arp_recv() can race with rlb_deinitialize() and dereference\na freed rx_hashtbl entry.\n\nFix this by setting recv_probe to NULL and then calling\nsynchronize_net() to wait for any concurrent RX processing to finish.\nThis ensures that no RX handler can access rx_hashtbl after it is freed\nin bond_alb_deinitialize()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached via a received ARP frame on a bond slave; an unprivileged local user can reproduce the entire scenario inside a user namespace (`unshare -Urn`) by creating a balance-alb bond over veths, injecting ARP locally, and cycling the bond up/down, so no network/adjacent position is required.\nAC:L - In the user-namespace scenario the attacker controls both sides of the race \u2014 the ARP injection (RX side) and the bond up/down cycling (free side) \u2014 and the upstream report confirms it is readily reproducible by repeated cycling, so the race can be won reliably.\nPR:L - Triggering the free requires CAP_NET_ADMIN on the bond, but this is obtainable by any unprivileged user via a user+network namespace (which also grants CAP_NET_RAW for ARP injection), so only basic local user privileges are needed.\nUI:N - No victim interaction is required; the attacker drives both the packet receipt and the bond teardown themselves.\nS:U - The vulnerability and its impact are confined to the kernel\u0027s own security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The UAF reads the contents of the freed `rx_hashtbl` object (after potential reallocation), which can be leveraged to disclose attacker-influenced or adjacent kernel heap data.\nI:H - The UAF writes into the freed/reallocated object, including copying 6 attacker-controlled bytes (the ARP source MAC) and link-pointer updates, providing a write primitive into reclaimed heap memory exploitable for control-flow corruption.\nA:H - The bug causes a KASAN-detected general protection fault / kernel oops (as shown in the report), reliably crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:58.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c"
        },
        {
          "url": "https://git.kernel.org/stable/c/de7c097800f07f3c108185c7a38b53a530ba30ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/db5435b5342e3aaa4521d0f3ccfe94316b253ca1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94a0de7b9f32745a14a1621c63087a092823587"
        },
        {
          "url": "https://git.kernel.org/stable/c/c65cdf46ce340c9c00fbbaf84599d2daff43626e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fef13c403be3fb685cb06419e6b3623106aab5ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/d31065526f160ee0244a719230aa069daca2bf4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6834a4c474697df23ab9948fd3577b26bf48656"
        }
      ],
      "title": "bonding: alb: fix UAF in rlb_arp_recv during bond up/down",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45970",
    "datePublished": "2026-05-27T12:18:29.878Z",
    "dateReserved": "2026-05-13T15:03:33.089Z",
    "dateUpdated": "2026-08-05T12:28:58.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.50.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.42.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the `zram_bvec_write_partial()` function allows an asynchronous read to write into a page that has already been deallocated. Such a flaw can lead to system instability, causing crashes, or in some scenarios, could be exploited by a local attacker to escalate privileges or execute arbitrary code."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-364",
                "description": "Signal Handler Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T12:04:28.891Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53185"
          },
          {
            "name": "RHBZ#2492735",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492735"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53185.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61887"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59723"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59723: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: zram: fix use-after-free in zram_bvec_write_partial()",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent module zram from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c2821665ff71be3f4b07ecece384669f2877f6a",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "77a602b505ce4802915853cfc435a4722fab3e64",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "c96786d6ff1acc1d54d9241e97767554c1dfdd5b",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "198b5a14cca27263b9c14b20114c8092de15dfcb",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "732fd9f0b9c1cdc6dfd77162ded60df005182cc0",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix use-after-free in zram_bvec_write_partial()\n\nzram_read_page() picks the sync or async backing device read path based on\nwhether the parent bio is NULL.  zram_bvec_write_partial() passes its\nparent bio down, so for ZRAM_WB slots the read is dispatched\nasynchronously and zram_read_page() returns 0 while the bio is still in\nflight.  The caller then runs memcpy_from_bvec(), zram_write_page() and\n__free_page() on the buffer, leaving the async read to write into a freed\npage.\n\nzram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d\n(\"zram: fix synchronous reads\") for the same reason; the write_partial\ncounterpart was missed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachability is through local block-device or filesystem I/O that submits writes to a zram device. There is no network, adjacent, or physical transport path into this driver code.\nAC:L - On affected non-4K-page zram writeback deployments, the attacker can create partial bio_vec writes and target ZRAM_WB slots without winning a race. The bug is a deterministic asynchronous lifetime error once that normal writeback state exists.\nPR:L - zram_submit_bio() and zram_open() add no kernel capability check; access is governed by the device node or a mounted zram-backed filesystem. A normal local user with write access to such storage can trigger the vulnerable I/O path, while admin-only setup is an environmental prerequisite.\nUI:N - No victim action is needed after the attacker has local write access to the zram-backed storage. The attacker directly submits or induces the partial write.\nS:U - The corruption occurs in kernel memory within the same host security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - This is a kernel use-after-free of a page later written by asynchronous backing-device I/O. Under the required overestimation rule, such memory corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The freed page can be reallocated before the asynchronous I/O completes, causing kernel memory to be overwritten. That supports high integrity impact due to potential arbitrary corruption or code execution primitives.\nA:H - The UAF can corrupt live kernel memory and readily cause an oops, panic, or hang. Repeated local triggering can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:52.156Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/77a602b505ce4802915853cfc435a4722fab3e64"
        },
        {
          "url": "https://git.kernel.org/stable/c/c96786d6ff1acc1d54d9241e97767554c1dfdd5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/198b5a14cca27263b9c14b20114c8092de15dfcb"
        },
        {
          "url": "https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0"
        }
      ],
      "title": "zram: fix use-after-free in zram_bvec_write_partial()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53185",
    "datePublished": "2026-06-25T08:38:58.853Z",
    "dateReserved": "2026-06-09T07:44:35.390Z",
    "dateUpdated": "2026-09-02T12:04:28.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs_nfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "76b94cbd32aacf36a641956385a852635c6802b9",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "c8e4e0c701d0192a2efb6df059c0f9e19678c23d",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "427ab81a811dab4bca9d19f82eec5847ae42646e",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "012d37a568bfbb2c9686f03ade75560bc7139956",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "30aae62e50b4e074a90a9a5e15246548fbdc1182",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "41fe0f7b84f0cb822ae10ab08592996a592b2a25",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs_nfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr\n\nnfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a\nnetaddr4 from a GETDEVICEINFO multipath-DS body, then immediately\ncalls strrchr(buf, \u0027.\u0027) to locate the port separator. Both decodes\nuse xdr_stream_decode_string_dup(), and the current code checks only\n\"nlen \u003c 0\" / \"rlen \u003c 0\" before dereferencing the returned string.\n\nWhen the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()\nreturns 0 and xdr_stream_decode_string_dup() falls through to its\n\"*str = NULL; return ret\" tail, leaving buf NULL with a return value\nof 0. The \"\u003c 0\" check does not catch this, and the next line is\nstrrchr(NULL, \u0027.\u0027), a kernel NULL pointer dereference reachable from\nany pNFS-flexfile client mounted against a malicious or compromised\nmetadata server.\n\nReject the zero-length cases explicitly so the decoder fails with\n-EBADMSG (treated as a malformed GETDEVICEINFO body) instead of\npanicking the client."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario\u2014a compromised enterprise/HPC metadata server or autofs-managed pNFS mount\u2014no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive\u2014only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:42.650Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e"
        },
        {
          "url": "https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956"
        },
        {
          "url": "https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182"
        },
        {
          "url": "https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25"
        }
      ],
      "title": "NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53391",
    "datePublished": "2026-07-19T12:01:55.521Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:42.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayout.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9033591535c066726f5b505126ccb4068b98fa4f",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "18cc6d57a14fa65ab2a2b52279f549041c4bc9cf",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "be7829715e341b42846437dd9e721005db59f0cc",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "eeabb9020721db6bc132e68eeae380b8d4fb4b04",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "7779c85028a0676fb190cde4f0c540f4f8e97761",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "d8c90c7cc061265d5f2813a1f5c82ef2f4707e67",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "2131ed64b767ffa8bcdb3677d90f3964e39aabc8",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayout.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: reject zero filehandle version count\n\nff_layout_alloc_lseg() decodes the filehandle-version array count\nfrom the flexfiles layout body. The value is used as the count for\nkzalloc_objs(), and the current code only rejects NULL.\n\nA zero count yields ZERO_SIZE_PTR, which can be stored in\ndss_info-\u003efh_versions even though later flexfiles paths assume that at\nleast one filehandle version exists.\n\nReject fh_count == 0 before the allocation, matching the existing zero\nversion_count validation in the flexfiles GETDEVICEINFO parser.\n\nA QEMU/KASAN run with a malformed flexfiles layout hit:\n\n  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n  RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750\n  ff_layout_encode_layoutreturn+0x683/0x970\n  nfs4_xdr_enc_layoutreturn+0x278/0x3a0\n  Kernel panic - not syncing: Fatal exception\n\nThe patched kernel rejects the malformed layout without KASAN/oops/panic,\nand a valid fh_count=1 regression still opens, reads, and unmounts cleanly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the NFSv4 pNFS flexfiles client parsing a malicious LAYOUTGET layout blob from the server over NFS/RPC; a remote attacker who controls or MITMs the NFS server delivers the crafted fh_count=0 response over the network.\nAC:L - Once a client is using flexfiles pNFS, the attacker fully controls the layout XDR and can set fh_count=0 to deterministically store ZERO_SIZE_PTR; a later I/O, layoutstats, or LAYOUTRETURN path dereferences fh_versions[0] and panics without races or special heap layout.\nPR:N - Exploitation requires no privileges on the victim host; the attacker only needs to be the (or impersonate) the NFS server sending protocol responses after normal client connection/authentication.\nUI:N - After an NFS pNFS flexfiles mount is established (common in enterprise/HPC NAS deployments), triggering the malformed layout and subsequent kernel panic requires no further victim action beyond routine file access on the already-mounted share.\nS:U - Impact is a kernel oops/panic on the NFS client host; it does not cross a VM, container, or IOMMU security boundary to affect a different authority.\nC:N - The failure mode is a NULL-pointer dereference at ZERO_SIZE_PTR (0x10) when accessing fh_versions[0]; KASAN confirms a faulting dereference with no successful out-of-bounds read or information leak to userspace.\nI:N - There is no memory corruption or successful write primitive\u2014only an invalid-pointer dereference that crashes the kernel before any integrity-changing operation completes.\nA:H - A confirmed KASAN null-ptr-deref in ff_layout_encode_ff_layoutupdate during LAYOUTRETURN encoding causes a fatal kernel exception/panic, fully denying availability of the client system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:43.747Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04"
        },
        {
          "url": "https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67"
        },
        {
          "url": "https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2"
        }
      ],
      "title": "NFSv4/flexfiles: reject zero filehandle version count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53392",
    "datePublished": "2026-07-19T12:01:56.101Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:43.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs2acl.c",
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b2eb1ffd511d1b3c3e21122f97cbbccea411e277",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "b94c4be77682aab06d65ca7296149e3bcfb37353",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "887f92ceccf3eacd5f2402db21254d66372fae00",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "1e96239fddcefacf6afe6c498357be68eacbcabc",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "bd69a825485168ef74e815ecb286754b570fdcc7",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "136b416593f1349cf6f72c8e3d18f0f204ee8545",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "a5b42c1e4ff2befaa6b96f7cbf32174751eba083",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "0853ac544c590880d797b04daa33fcb72b6be0e1",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs2acl.c",
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl leak on SETACL decode failure\n\nnfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each\ncall nfs_stream_decode_acl() twice, first for NFS_ACL and then for\nNFS_DFACL.  Each successful call transfers ownership of a freshly\nallocated posix_acl into argp-\u003eacl_access or argp-\u003eacl_default.  If\nthe first call succeeds but the second fails, the decoder returns\nfalse and argp-\u003eacl_access is left dangling.\n\nACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and\nACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.\nBoth only call fh_put() and have no knowledge of the ACL fields on\nargp.  The posix_acl_release() pairs sat at the out: labels inside\nnfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()\nskips pc_func when pc_decode returns false, so that cleanup is\nunreachable on decode failure:\n\n    svc_process_common()\n      pc_decode()                  /* decode_setaclargs: false */\n      /* pc_func skipped */\n      pc_release()                 /* fh_put only -- ACLs leaked */\n\nThe orphaned posix_acl is leaked for the lifetime of the server.\n\nFix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),\nwhich release both argp-\u003eacl_access and argp-\u003eacl_default in addition\nto fh_put(), and wiring them as pc_release for their respective SETACL\nprocedures.  pc_release runs on every path svc_process() takes after\ndecode, including decode failure, so the posix_acl_release() pairs are\nremoved from the proc functions\u0027 out: labels to keep ownership in one\nplace.  This matches the existing release_getacl() pattern used by\nthe sibling GETACL procedures."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in nfsd\u0027s NFS ACL program (RPC program 100227), reachable over the network via the in-kernel NFS server on TCP/UDP port 2049 when NFSD ACL support is enabled.\nAC:L - Once nfsd with ACL support is running, an attacker can reliably trigger the leak by sending a SETACL RPC with mask including both NFS_ACL and NFS_DFACL, a valid first ACL, and a malformed second ACL that fails decode.\nPR:N - Exploitation requires only network access as an NFS client with RPC credentials (AUTH_UNIX is spoofable) from a source IP matching an export entry; no local shell or real root on the server is needed.\nUI:N - Triggering the leak requires only crafted NFS ACL RPC packets; no victim user action such as mounting a filesystem or opening a file is required.\nS:U - The impact is confined to kernel memory consumption within the nfsd server context and does not cross a security boundary such as a VM, container, or IOMMU isolation boundary.\nC:N - This is a kmalloc leak of attacker-supplied ACL data with no out-of-bounds read, use-after-free, or other mechanism that exposes kernel memory to the attacker.\nI:N - The bug orphans allocated posix_acl objects without modifying file data, ACLs on disk, or any other integrity-protected resources.\nA:H - Each trigger permanently leaks a posix_acl allocation (up to ~16KB with max entries) for the server\u0027s lifetime; repeated remote SETACL requests can exhaust kernel memory and deny service to the NFS server and co-hosted workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:49.240Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277"
        },
        {
          "url": "https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353"
        },
        {
          "url": "https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083"
        },
        {
          "url": "https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1"
        }
      ],
      "title": "nfsd: fix posix_acl leak on SETACL decode failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53397",
    "datePublished": "2026-07-19T12:01:58.938Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:49.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d788ef40a7517d22c97ab01700e4ae4c611b6f2f",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "2e0a5d6d62600b8c614d1b55e50ef94035d6adf9",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "7bbb7ce74051c8be4b69ff44ce3db370600dae61",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "48a586e382e4db1dbf958d44b63e081df5f8ed04",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "d369e5edfaaf83a448016e2f1da392b2174be801",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "83c2b7797742339bb768f83935f7ca33950db138",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "30d55c8aabb261bc3f427d6b9aae7ef6206063f9",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl-\u003ecl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls-\u003els_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls-\u003els_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(\u0026ls-\u003els_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n    nfsd4_alloc_layout_stateid()\n      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */\n      nfsd4_layout_setlease()     /* fails */\n        nfs4_put_stid()\n          nfsd4_free_layout_stateid()\n            delayed_work_pending(\u0026ls-\u003els_fence_work)  /* needs INIT */\n            nfsd4_close_layout()  /* nfsd_file_put(ls-\u003els_file) */\n          put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached through nfsd\u0027s NFSv4 OP_LAYOUTGET handler, which processes attacker-controlled RPC compounds over the network on TCP port 2049.\nAC:L - An authenticated NFS client can reliably trigger the fault by issuing LAYOUTGET on block/SCSI pNFS exports so that nfsd4_layout_setlease() fails (e.g., -ENOMEM or -EINVAL), and can retry, spray the slab, and race concurrent compounds to exploit the dangling IDR entry.\nPR:N - Exploitation requires only the ability to act as a remote NFSv4 client against an export with pNFS enabled, not local shell access or elevated privileges on the Linux host.\nUI:N - No end-user or administrator action on the server is required; the vulnerability is triggered entirely through malicious NFS protocol traffic from a network client.\nS:U - Impact is confined to kernel memory corruption and nfsd state within the same kernel security boundary, not a cross-boundary escape such as VM or container breakout.\nC:H - The IDR retains a pointer to freed layout stateid slab memory, creating a use-after-free that can be leveraged for arbitrary kernel memory reads after heap reuse.\nI:H - UAF on the layout stateid object enables controlled slab reuse and corruption of adjacent kernel structures, supporting arbitrary write or control-flow hijack primitives.\nA:H - Dereferencing the dangling IDR pointer during state iteration or stateid lookup can cause kernel oops/panic, and UAF exploitation can crash or hang the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:51.453Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04"
        },
        {
          "url": "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138"
        },
        {
          "url": "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9"
        }
      ],
      "title": "nfsd: release layout stid on setlease failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53399",
    "datePublished": "2026-07-19T12:02:00.055Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:51.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98",
              "status": "affected",
              "version": "06f58dbc49a23c99e5c0f246879ed16667f7bf8f",
              "versionType": "git"
            },
            {
              "lessThan": "1f24b8302c77dcaf79c64c073877a3b9f4dd25d2",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "9c0fb5c09ae5bd68dc0038692af8127029cb0385",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "7e37e9b3e82ade881e1798e2f4fcc54aff7793c1",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "2883ddd7542b4437a2ab4908fe2773f690e20889",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "200e7637f4d6a1342987045eea72641524f909dc",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "9645aaf689aff57427ece3b9fa47d5b5399417f4",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "13e198a90ca4050f4bee8a3f23680389a6563ccc",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aa2399f55eff4ec78330bb6fe55f9df53e5cae0c",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.260",
              "status": "affected",
              "version": "5.10.9",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.91",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "5.10.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.91",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix use-after-free in pnfs_update_layout()\n\nWhen hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(),\nthe code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds,\npnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(),\nwhich still references \u0027lo\u0027. This results in a use-after-free when the\ntracepoint accesses lo\u0027s fields.\n\nFix this by moving the tracepoint call before pnfs_put_layout_hdr(lo)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A compromised or malicious pNFS NFSv4.1+ metadata server can send CB_LAYOUTRECALL callbacks over the NFSv4 backchannel to force NFS_LAYOUT_RETURN while client file I/O reaches pnfs_update_layout(), exploiting the client from the network in typical enterprise/HPC pNFS deployments.\nAC:L - The attacker controls both sides of the race by issuing layout recalls from the server and driving or waiting for concurrent read/write I/O on the mounted pNFS share; no conditions beyond attacker influence are required once a pNFS session exists.\nPR:N - Exploitation requires no local privileges on the victim client\u2014a remote NFS server with an established pNFS session can trigger the layoutreturn/retry path while any client process performs permitted file I/O on the mount.\nUI:N - No interactive victim action is needed during exploitation; automated workloads, daemons, or batch jobs performing routine I/O on an existing pNFS mount are sufficient to hit the vulnerable code path.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security domain and does not cross a VM, container, or IOMMU boundary on its own.\nC:H - The tracepoint reads freed pnfs_layout_hdr fields (plh_stateid seqid and hash) after pnfs_put_layout_hdr() drops the final reference, giving an attacker-controlled use-after-free read primitive over kernel heap memory.\nI:H - Use-after-free on a refcounted kernel layout object enables heap grooming and further memory corruption for arbitrary kernel writes or control-flow hijacking, not merely a bounded fault.\nA:H - Dereferencing a freed pnfs_layout_hdr in kernel context can cause an oops or panic, and use-after-free corruption reliably threatens system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:05.578Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f24b8302c77dcaf79c64c073877a3b9f4dd25d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c0fb5c09ae5bd68dc0038692af8127029cb0385"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2883ddd7542b4437a2ab4908fe2773f690e20889"
        },
        {
          "url": "https://git.kernel.org/stable/c/200e7637f4d6a1342987045eea72641524f909dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9645aaf689aff57427ece3b9fa47d5b5399417f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/13e198a90ca4050f4bee8a3f23680389a6563ccc"
        }
      ],
      "title": "pNFS: Fix use-after-free in pnfs_update_layout()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63800",
    "datePublished": "2026-07-19T12:02:06.897Z",
    "dateReserved": "2026-07-19T07:54:57.013Z",
    "dateUpdated": "2026-08-17T04:51:05.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/hw_channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ddc715324badd7f2641bc177db1d027b402adae",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "ff1d5af207bcea857d45fe81505f1bc4b29eaef0",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "763a372d344fb12fae566d36ddb46e92454ad58c",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "fa627a5eaa83fc0261f44ef3769693b886ca6e27",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "355e9f2b2a7887ca38100127989af3e422ba71d0",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "b809d0409991b75a6cff846a5ac27c3062953f84",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/hw_channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: validate rx_req_idx to prevent out-of-bounds array access\n\nIn mana_hwc_rx_event_handler(), rx_req_idx is derived from\nsge-\u003eaddress in DMA-coherent memory. In Confidential VMs\n(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify\nWQE contents at any time. No bounds check exists on rx_req_idx,\nwhich can lead to an out-of-bounds access into reqs[].\n\nAdd bounds check on rx_req_idx in mana_hwc_rx_event_handler() before\nusing it to index the reqs[] array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge-\u003eaddress and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:15.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0"
        },
        {
          "url": "https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01"
        },
        {
          "url": "https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27"
        },
        {
          "url": "https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84"
        }
      ],
      "title": "net: mana: validate rx_req_idx to prevent out-of-bounds array access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64018",
    "datePublished": "2026-07-19T15:39:12.704Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:15.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}