Vulnerability-Lookup

CERTFR-2026-AVI-1069

Vulnerability from certfr_avis - Published: 2026-08-21 - Updated: 2026-08-21

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian 12 bookworm versions antérieures à 6.12.101-1~deb12u1

References

Title

Publication Time

Tags

Bulletin de sécurité Debian LTS msg00035

2026-08-18

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.12.101-1~deb12u1",
      "product": {
        "name": "Debian",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-68116",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68116"
    },
    {
      "name": "CVE-2026-68147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68147"
    },
    {
      "name": "CVE-2026-68343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68343"
    },
    {
      "name": "CVE-2026-68450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68450"
    },
    {
      "name": "CVE-2026-68271",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68271"
    },
    {
      "name": "CVE-2026-64561",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64561"
    },
    {
      "name": "CVE-2026-72051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72051"
    },
    {
      "name": "CVE-2026-68416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68416"
    },
    {
      "name": "CVE-2026-68193",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68193"
    },
    {
      "name": "CVE-2026-68388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68388"
    },
    {
      "name": "CVE-2026-68204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68204"
    },
    {
      "name": "CVE-2026-68302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68302"
    },
    {
      "name": "CVE-2026-68141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68141"
    },
    {
      "name": "CVE-2026-68225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68225"
    },
    {
      "name": "CVE-2026-53090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53090"
    },
    {
      "name": "CVE-2026-68339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68339"
    },
    {
      "name": "CVE-2026-68439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68439"
    },
    {
      "name": "CVE-2026-68218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68218"
    },
    {
      "name": "CVE-2026-68129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68129"
    },
    {
      "name": "CVE-2026-68245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68245"
    },
    {
      "name": "CVE-2026-68428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68428"
    },
    {
      "name": "CVE-2026-68313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68313"
    },
    {
      "name": "CVE-2026-72130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72130"
    },
    {
      "name": "CVE-2026-68317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68317"
    },
    {
      "name": "CVE-2026-68443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68443"
    },
    {
      "name": "CVE-2026-68326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68326"
    },
    {
      "name": "CVE-2026-68184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68184"
    },
    {
      "name": "CVE-2026-68228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68228"
    },
    {
      "name": "CVE-2026-72125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72125"
    },
    {
      "name": "CVE-2026-68417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68417"
    },
    {
      "name": "CVE-2026-68338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68338"
    },
    {
      "name": "CVE-2026-68248",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68248"
    },
    {
      "name": "CVE-2026-68165",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68165"
    },
    {
      "name": "CVE-2026-68277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68277"
    },
    {
      "name": "CVE-2026-72015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72015"
    },
    {
      "name": "CVE-2026-68410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68410"
    },
    {
      "name": "CVE-2026-68437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68437"
    },
    {
      "name": "CVE-2026-68261",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68261"
    },
    {
      "name": "CVE-2026-68128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68128"
    },
    {
      "name": "CVE-2026-68164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68164"
    },
    {
      "name": "CVE-2026-68304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68304"
    },
    {
      "name": "CVE-2026-68155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68155"
    },
    {
      "name": "CVE-2026-45901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45901"
    },
    {
      "name": "CVE-2026-64574",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64574"
    },
    {
      "name": "CVE-2026-68294",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68294"
    },
    {
      "name": "CVE-2026-68102",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68102"
    },
    {
      "name": "CVE-2026-68385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68385"
    },
    {
      "name": "CVE-2026-68446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68446"
    },
    {
      "name": "CVE-2026-68408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68408"
    },
    {
      "name": "CVE-2026-68226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68226"
    },
    {
      "name": "CVE-2026-68350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68350"
    },
    {
      "name": "CVE-2026-68419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68419"
    },
    {
      "name": "CVE-2026-68297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68297"
    },
    {
      "name": "CVE-2026-68199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68199"
    },
    {
      "name": "CVE-2026-68296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68296"
    },
    {
      "name": "CVE-2026-68425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68425"
    },
    {
      "name": "CVE-2026-68293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68293"
    },
    {
      "name": "CVE-2026-68365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68365"
    },
    {
      "name": "CVE-2026-72183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72183"
    },
    {
      "name": "CVE-2026-72254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72254"
    },
    {
      "name": "CVE-2026-68320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68320"
    },
    {
      "name": "CVE-2026-68176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68176"
    },
    {
      "name": "CVE-2026-68280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68280"
    },
    {
      "name": "CVE-2026-68362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68362"
    },
    {
      "name": "CVE-2026-68430",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68430"
    },
    {
      "name": "CVE-2026-68427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68427"
    },
    {
      "name": "CVE-2026-68324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68324"
    },
    {
      "name": "CVE-2026-68308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68308"
    },
    {
      "name": "CVE-2026-68179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68179"
    },
    {
      "name": "CVE-2026-72260",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72260"
    },
    {
      "name": "CVE-2026-68210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68210"
    },
    {
      "name": "CVE-2026-68120",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68120"
    },
    {
      "name": "CVE-2026-72372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72372"
    },
    {
      "name": "CVE-2026-68309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68309"
    },
    {
      "name": "CVE-2026-68096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68096"
    },
    {
      "name": "CVE-2026-68403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68403"
    },
    {
      "name": "CVE-2026-68139",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68139"
    },
    {
      "name": "CVE-2026-68442",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68442"
    },
    {
      "name": "CVE-2026-68093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68093"
    },
    {
      "name": "CVE-2026-64584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64584"
    },
    {
      "name": "CVE-2026-72299",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72299"
    },
    {
      "name": "CVE-2026-68310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68310"
    },
    {
      "name": "CVE-2026-68115",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68115"
    },
    {
      "name": "CVE-2026-68133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68133"
    },
    {
      "name": "CVE-2026-68221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68221"
    },
    {
      "name": "CVE-2026-68246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68246"
    },
    {
      "name": "CVE-2026-64563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64563"
    },
    {
      "name": "CVE-2026-68405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68405"
    },
    {
      "name": "CVE-2026-68219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68219"
    },
    {
      "name": "CVE-2026-68216",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68216"
    },
    {
      "name": "CVE-2026-64580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64580"
    },
    {
      "name": "CVE-2026-68328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68328"
    },
    {
      "name": "CVE-2026-68394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68394"
    },
    {
      "name": "CVE-2026-68196",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68196"
    },
    {
      "name": "CVE-2026-64280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64280"
    },
    {
      "name": "CVE-2026-68269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68269"
    },
    {
      "name": "CVE-2026-68255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68255"
    },
    {
      "name": "CVE-2026-72017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72017"
    },
    {
      "name": "CVE-2026-68363",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68363"
    },
    {
      "name": "CVE-2026-68213",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68213"
    },
    {
      "name": "CVE-2026-68278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68278"
    },
    {
      "name": "CVE-2026-68145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68145"
    },
    {
      "name": "CVE-2026-72113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72113"
    },
    {
      "name": "CVE-2026-68361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68361"
    },
    {
      "name": "CVE-2026-68181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68181"
    },
    {
      "name": "CVE-2026-64570",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64570"
    },
    {
      "name": "CVE-2026-68113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68113"
    },
    {
      "name": "CVE-2026-72213",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72213"
    },
    {
      "name": "CVE-2026-68160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68160"
    },
    {
      "name": "CVE-2026-68100",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68100"
    },
    {
      "name": "CVE-2026-68157",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68157"
    },
    {
      "name": "CVE-2026-68368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68368"
    },
    {
      "name": "CVE-2026-68281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68281"
    },
    {
      "name": "CVE-2026-68335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68335"
    },
    {
      "name": "CVE-2026-68329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68329"
    },
    {
      "name": "CVE-2026-68189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68189"
    },
    {
      "name": "CVE-2026-68212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68212"
    },
    {
      "name": "CVE-2026-64568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64568"
    },
    {
      "name": "CVE-2026-72101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72101"
    },
    {
      "name": "CVE-2026-68119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68119"
    },
    {
      "name": "CVE-2026-68389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68389"
    },
    {
      "name": "CVE-2026-68314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68314"
    },
    {
      "name": "CVE-2026-68215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68215"
    },
    {
      "name": "CVE-2026-68099",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68099"
    },
    {
      "name": "CVE-2026-68369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68369"
    },
    {
      "name": "CVE-2026-72253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72253"
    },
    {
      "name": "CVE-2026-68340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68340"
    },
    {
      "name": "CVE-2026-72137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72137"
    },
    {
      "name": "CVE-2026-68352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68352"
    },
    {
      "name": "CVE-2026-68106",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68106"
    },
    {
      "name": "CVE-2026-72103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72103"
    },
    {
      "name": "CVE-2026-68197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68197"
    },
    {
      "name": "CVE-2026-72040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72040"
    },
    {
      "name": "CVE-2026-68315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68315"
    },
    {
      "name": "CVE-2026-68346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68346"
    },
    {
      "name": "CVE-2026-68377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68377"
    },
    {
      "name": "CVE-2026-72114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72114"
    },
    {
      "name": "CVE-2026-68175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68175"
    },
    {
      "name": "CVE-2026-68413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68413"
    },
    {
      "name": "CVE-2026-68372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68372"
    },
    {
      "name": "CVE-2026-68357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68357"
    },
    {
      "name": "CVE-2026-68376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68376"
    },
    {
      "name": "CVE-2026-64583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64583"
    },
    {
      "name": "CVE-2026-68262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68262"
    },
    {
      "name": "CVE-2026-68194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68194"
    },
    {
      "name": "CVE-2026-68127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68127"
    },
    {
      "name": "CVE-2026-68112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68112"
    },
    {
      "name": "CVE-2026-72142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72142"
    },
    {
      "name": "CVE-2026-72062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72062"
    },
    {
      "name": "CVE-2026-68146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68146"
    },
    {
      "name": "CVE-2026-68202",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68202"
    },
    {
      "name": "CVE-2026-68104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68104"
    },
    {
      "name": "CVE-2026-72065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72065"
    },
    {
      "name": "CVE-2026-68137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68137"
    },
    {
      "name": "CVE-2026-68143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68143"
    },
    {
      "name": "CVE-2026-68349",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68349"
    },
    {
      "name": "CVE-2026-68257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68257"
    },
    {
      "name": "CVE-2026-68252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68252"
    },
    {
      "name": "CVE-2026-72070",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72070"
    },
    {
      "name": "CVE-2026-68351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68351"
    },
    {
      "name": "CVE-2026-68301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68301"
    },
    {
      "name": "CVE-2026-68402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68402"
    },
    {
      "name": "CVE-2026-68117",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68117"
    },
    {
      "name": "CVE-2026-68333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68333"
    },
    {
      "name": "CVE-2026-68386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68386"
    },
    {
      "name": "CVE-2026-68111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68111"
    },
    {
      "name": "CVE-2026-64577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64577"
    },
    {
      "name": "CVE-2026-68142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68142"
    },
    {
      "name": "CVE-2026-68243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68243"
    },
    {
      "name": "CVE-2026-68209",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68209"
    },
    {
      "name": "CVE-2026-68306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68306"
    },
    {
      "name": "CVE-2026-68207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68207"
    },
    {
      "name": "CVE-2026-68373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68373"
    },
    {
      "name": "CVE-2026-68185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68185"
    },
    {
      "name": "CVE-2026-68206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68206"
    },
    {
      "name": "CVE-2026-68110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68110"
    },
    {
      "name": "CVE-2026-72117",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72117"
    },
    {
      "name": "CVE-2026-68391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68391"
    },
    {
      "name": "CVE-2026-68227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68227"
    },
    {
      "name": "CVE-2026-68348",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68348"
    },
    {
      "name": "CVE-2026-68331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68331"
    },
    {
      "name": "CVE-2025-40098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40098"
    },
    {
      "name": "CVE-2026-72030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72030"
    },
    {
      "name": "CVE-2026-68432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68432"
    },
    {
      "name": "CVE-2026-68319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68319"
    },
    {
      "name": "CVE-2026-68186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68186"
    },
    {
      "name": "CVE-2026-68148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68148"
    },
    {
      "name": "CVE-2026-68344",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68344"
    },
    {
      "name": "CVE-2026-45897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45897"
    },
    {
      "name": "CVE-2026-64578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64578"
    },
    {
      "name": "CVE-2026-68398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68398"
    },
    {
      "name": "CVE-2026-68429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68429"
    },
    {
      "name": "CVE-2026-68136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68136"
    },
    {
      "name": "CVE-2026-68395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68395"
    },
    {
      "name": "CVE-2026-68144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68144"
    },
    {
      "name": "CVE-2026-68263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68263"
    },
    {
      "name": "CVE-2026-68299",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68299"
    },
    {
      "name": "CVE-2026-68366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68366"
    },
    {
      "name": "CVE-2026-68156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68156"
    },
    {
      "name": "CVE-2026-68187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68187"
    },
    {
      "name": "CVE-2026-68121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68121"
    },
    {
      "name": "CVE-2026-68231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68231"
    },
    {
      "name": "CVE-2026-68182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68182"
    },
    {
      "name": "CVE-2026-68422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68422"
    },
    {
      "name": "CVE-2026-68327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68327"
    },
    {
      "name": "CVE-2026-68358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68358"
    },
    {
      "name": "CVE-2026-68433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68433"
    },
    {
      "name": "CVE-2026-68190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68190"
    },
    {
      "name": "CVE-2026-68195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68195"
    },
    {
      "name": "CVE-2026-68318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68318"
    },
    {
      "name": "CVE-2026-68200",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68200"
    },
    {
      "name": "CVE-2026-68279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68279"
    },
    {
      "name": "CVE-2026-68205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68205"
    },
    {
      "name": "CVE-2026-68234",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68234"
    },
    {
      "name": "CVE-2026-68311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68311"
    },
    {
      "name": "CVE-2026-68321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68321"
    },
    {
      "name": "CVE-2026-68256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68256"
    },
    {
      "name": "CVE-2026-68140",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68140"
    },
    {
      "name": "CVE-2026-68445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68445"
    },
    {
      "name": "CVE-2026-64562",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64562"
    },
    {
      "name": "CVE-2026-72023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72023"
    },
    {
      "name": "CVE-2026-68434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68434"
    },
    {
      "name": "CVE-2026-68444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68444"
    },
    {
      "name": "CVE-2026-68153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68153"
    },
    {
      "name": "CVE-2026-64571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64571"
    },
    {
      "name": "CVE-2026-72168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72168"
    },
    {
      "name": "CVE-2026-68188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68188"
    },
    {
      "name": "CVE-2026-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68161"
    },
    {
      "name": "CVE-2026-68259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68259"
    },
    {
      "name": "CVE-2026-68235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68235"
    },
    {
      "name": "CVE-2026-68223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68223"
    },
    {
      "name": "CVE-2026-72116",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72116"
    },
    {
      "name": "CVE-2026-72244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72244"
    },
    {
      "name": "CVE-2026-68414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68414"
    },
    {
      "name": "CVE-2026-68411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68411"
    },
    {
      "name": "CVE-2026-68131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68131"
    },
    {
      "name": "CVE-2026-68214",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68214"
    },
    {
      "name": "CVE-2026-68217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68217"
    },
    {
      "name": "CVE-2026-68222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68222"
    },
    {
      "name": "CVE-2026-72045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72045"
    },
    {
      "name": "CVE-2026-68124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68124"
    },
    {
      "name": "CVE-2026-68381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68381"
    },
    {
      "name": "CVE-2026-72305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72305"
    },
    {
      "name": "CVE-2026-68250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68250"
    },
    {
      "name": "CVE-2026-68371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68371"
    },
    {
      "name": "CVE-2026-68397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68397"
    },
    {
      "name": "CVE-2026-64572",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64572"
    },
    {
      "name": "CVE-2026-68126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68126"
    },
    {
      "name": "CVE-2026-68396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68396"
    },
    {
      "name": "CVE-2026-72147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72147"
    },
    {
      "name": "CVE-2026-68449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68449"
    },
    {
      "name": "CVE-2026-68125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68125"
    },
    {
      "name": "CVE-2026-68135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68135"
    },
    {
      "name": "CVE-2026-72121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72121"
    },
    {
      "name": "CVE-2026-72032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72032"
    },
    {
      "name": "CVE-2026-68374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68374"
    },
    {
      "name": "CVE-2026-68360",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68360"
    },
    {
      "name": "CVE-2026-68244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68244"
    },
    {
      "name": "CVE-2026-64579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64579"
    },
    {
      "name": "CVE-2026-68249",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68249"
    },
    {
      "name": "CVE-2026-68107",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68107"
    },
    {
      "name": "CVE-2026-72146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72146"
    },
    {
      "name": "CVE-2026-72175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72175"
    },
    {
      "name": "CVE-2026-68392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68392"
    },
    {
      "name": "CVE-2026-68300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68300"
    },
    {
      "name": "CVE-2026-68260",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68260"
    },
    {
      "name": "CVE-2026-68229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68229"
    },
    {
      "name": "CVE-2026-68284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68284"
    },
    {
      "name": "CVE-2026-68152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68152"
    },
    {
      "name": "CVE-2026-68353",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68353"
    },
    {
      "name": "CVE-2026-68108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68108"
    },
    {
      "name": "CVE-2026-64565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64565"
    },
    {
      "name": "CVE-2026-68158",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68158"
    },
    {
      "name": "CVE-2026-64573",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64573"
    },
    {
      "name": "CVE-2026-68325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68325"
    },
    {
      "name": "CVE-2026-68307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68307"
    },
    {
      "name": "CVE-2026-68355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68355"
    },
    {
      "name": "CVE-2026-68098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68098"
    },
    {
      "name": "CVE-2026-74436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74436"
    },
    {
      "name": "CVE-2026-68097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68097"
    },
    {
      "name": "CVE-2026-68180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68180"
    },
    {
      "name": "CVE-2026-68247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68247"
    },
    {
      "name": "CVE-2026-68407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68407"
    },
    {
      "name": "CVE-2026-68203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68203"
    },
    {
      "name": "CVE-2026-68123",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68123"
    },
    {
      "name": "CVE-2026-53078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53078"
    },
    {
      "name": "CVE-2026-64205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64205"
    },
    {
      "name": "CVE-2026-68162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68162"
    },
    {
      "name": "CVE-2026-68220",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68220"
    },
    {
      "name": "CVE-2026-68354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68354"
    },
    {
      "name": "CVE-2026-68149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68149"
    },
    {
      "name": "CVE-2026-68178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68178"
    },
    {
      "name": "CVE-2026-68183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68183"
    },
    {
      "name": "CVE-2026-68251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68251"
    },
    {
      "name": "CVE-2026-68151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68151"
    },
    {
      "name": "CVE-2026-72069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72069"
    },
    {
      "name": "CVE-2026-68359",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68359"
    },
    {
      "name": "CVE-2026-64290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64290"
    },
    {
      "name": "CVE-2026-68370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68370"
    },
    {
      "name": "CVE-2026-64567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64567"
    },
    {
      "name": "CVE-2026-68236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68236"
    },
    {
      "name": "CVE-2026-64576",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64576"
    },
    {
      "name": "CVE-2026-68192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68192"
    },
    {
      "name": "CVE-2026-72124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72124"
    },
    {
      "name": "CVE-2026-68272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68272"
    },
    {
      "name": "CVE-2026-64564",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64564"
    },
    {
      "name": "CVE-2026-72046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72046"
    },
    {
      "name": "CVE-2026-72119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72119"
    },
    {
      "name": "CVE-2026-68406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68406"
    },
    {
      "name": "CVE-2026-72115",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72115"
    },
    {
      "name": "CVE-2026-68130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68130"
    },
    {
      "name": "CVE-2026-72118",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72118"
    },
    {
      "name": "CVE-2026-68336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68336"
    },
    {
      "name": "CVE-2026-68201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68201"
    },
    {
      "name": "CVE-2026-64569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64569"
    },
    {
      "name": "CVE-2026-68290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68290"
    },
    {
      "name": "CVE-2026-68154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68154"
    }
  ],
  "initial_release_date": "2026-08-21T00:00:00",
  "last_revision_date": "2026-08-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1069",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
  "vendor_advisories": [
    {
      "published_at": "2026-08-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00035",
      "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00035.html"
    }
  ]
}

CVE-2025-40098 (GCVE-0-2025-40098)

Vulnerability from cvelistv5 – Published: 2025-10-30 09:48 – Updated: 2026-08-03 09:32

Title

ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/19129a365d2bd019f…
https://git.kernel.org/stable/c/b518386db2b993d78…
https://git.kernel.org/stable/c/8527bbb3393634052…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 447106e92a0c86c332d40710436f38f64c322cd6 , < 19129a365d2bd019fb60662b36b2655931997f12 (git) Affected: 447106e92a0c86c332d40710436f38f64c322cd6 , < b518386db2b993d786c431caa9f46ce063c5cb05 (git) Affected: 447106e92a0c86c332d40710436f38f64c322cd6 , < 8527bbb33936340525a3504a00932b2f8fd75754 (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.17.5 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/hda/codecs/side-codecs/cs35l41_hda.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19129a365d2bd019fb60662b36b2655931997f12",
              "status": "affected",
              "version": "447106e92a0c86c332d40710436f38f64c322cd6",
              "versionType": "git"
            },
            {
              "lessThan": "b518386db2b993d786c431caa9f46ce063c5cb05",
              "status": "affected",
              "version": "447106e92a0c86c332d40710436f38f64c322cd6",
              "versionType": "git"
            },
            {
              "lessThan": "8527bbb33936340525a3504a00932b2f8fd75754",
              "status": "affected",
              "version": "447106e92a0c86c332d40710436f38f64c322cd6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/hda/codecs/side-codecs/cs35l41_hda.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()\n\nReturn value of a function acpi_evaluate_dsm() is dereferenced  without\nchecking for NULL, but it is usually checked for this function.\n\nacpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns\nacpi_status other than ACPI_SUCCESS, so add a check to prevent the crach.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T09:32:26.104Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19129a365d2bd019fb60662b36b2655931997f12"
        },
        {
          "url": "https://git.kernel.org/stable/c/b518386db2b993d786c431caa9f46ce063c5cb05"
        },
        {
          "url": "https://git.kernel.org/stable/c/8527bbb33936340525a3504a00932b2f8fd75754"
        }
      ],
      "title": "ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40098",
    "datePublished": "2025-10-30T09:48:05.200Z",
    "dateReserved": "2025-04-16T07:20:57.164Z",
    "dateUpdated": "2026-08-03T09:32:26.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45897 (GCVE-0-2026-45897)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:17 – Updated: 2026-08-03 09:32

Title

netfilter: nft_counter: serialize reset with spinlock

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_counter: serialize reset with spinlock Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values. The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them. A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/48cf7918d10c66cb6…
https://git.kernel.org/stable/c/cd968dcdec6aee79a…
https://git.kernel.org/stable/c/0cdc6d5a26f2d1f7f…
https://git.kernel.org/stable/c/779c60a5190c42689…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < 48cf7918d10c66cb6b05226fa3fa5daf0c891089 (git) Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1 (git) Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < 0cdc6d5a26f2d1f7f15a43526841b679445c32e2 (git) Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < 779c60a5190c42689534172f4b49e927c9959e4e (git) Affected: fb1adb05ea87b6149e65a31e511756c4f470d0cd (git) Affected: f123293db16dcd0cd81b246ae60e6362f0025d0a (git) Affected: 6.1.107 , < 6.2 (semver) Affected: 6.6.48 , < 6.7 (semver)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_counter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48cf7918d10c66cb6b05226fa3fa5daf0c891089",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "0cdc6d5a26f2d1f7f15a43526841b679445c32e2",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "779c60a5190c42689534172f4b49e927c9959e4e",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fb1adb05ea87b6149e65a31e511756c4f470d0cd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f123293db16dcd0cd81b246ae60e6362f0025d0a",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.48",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_counter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.48",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_counter: serialize reset with spinlock\n\nAdd a global static spinlock to serialize counter fetch+reset\noperations, preventing concurrent dump-and-reset from underrunning\nvalues.\n\nThe lock is taken before fetching the total so that two parallel\nresets cannot both read the same counter values and then both\nsubtract them.\n\nA global lock is used for simplicity since resets are infrequent.\nIf this becomes a bottleneck, it can be replaced with a per-net\nlock later."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T09:32:30.454Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48cf7918d10c66cb6b05226fa3fa5daf0c891089"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cdc6d5a26f2d1f7f15a43526841b679445c32e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"
        }
      ],
      "title": "netfilter: nft_counter: serialize reset with spinlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45897",
    "datePublished": "2026-05-27T12:17:07.038Z",
    "dateReserved": "2026-05-13T15:03:33.083Z",
    "dateUpdated": "2026-08-03T09:32:30.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45901 (GCVE-0-2026-45901)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:17 – Updated: 2026-08-03 09:32

Title

netfilter: nf_tables: revert commit_mutex usage in reset path

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: revert commit_mutex usage in reset path It causes circular lock dependency between commit_mutex, nfnl_subsys_ipset and nlk_cb_mutex when nft reset, ipset list, and iptables-nft with '-m set' rule run at the same time. Previous patches made it safe to run individual reset handlers concurrently so commit_mutex is no longer required to prevent this.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/d66bedfe97a2bc321…
https://git.kernel.org/stable/c/f6410d18c1e2da325…
https://git.kernel.org/stable/c/ee3978b6a0dcd4215…
https://git.kernel.org/stable/c/7f261bb906bf527c4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < d66bedfe97a2bc321fa8118e669aae988038f729 (git) Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < f6410d18c1e2da325df02be989d5bca5ed38b086 (git) Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < ee3978b6a0dcd4215cb7cedcba705a12174786a7 (git) Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < 7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc (git) Affected: fb1adb05ea87b6149e65a31e511756c4f470d0cd (git) Affected: f123293db16dcd0cd81b246ae60e6362f0025d0a (git) Affected: 6.1.107 , < 6.2 (semver) Affected: 6.6.48 , < 6.7 (semver)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d66bedfe97a2bc321fa8118e669aae988038f729",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "f6410d18c1e2da325df02be989d5bca5ed38b086",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "ee3978b6a0dcd4215cb7cedcba705a12174786a7",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fb1adb05ea87b6149e65a31e511756c4f470d0cd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f123293db16dcd0cd81b246ae60e6362f0025d0a",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.48",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.48",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: revert commit_mutex usage in reset path\n\nIt causes circular lock dependency between commit_mutex, nfnl_subsys_ipset\nand nlk_cb_mutex when nft reset, ipset list, and iptables-nft with \u0027-m set\u0027\nrule run at the same time.\n\nPrevious patches made it safe to run individual reset handlers concurrently\nso commit_mutex is no longer required to prevent this."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T09:32:31.525Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d66bedfe97a2bc321fa8118e669aae988038f729"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6410d18c1e2da325df02be989d5bca5ed38b086"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee3978b6a0dcd4215cb7cedcba705a12174786a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc"
        }
      ],
      "title": "netfilter: nf_tables: revert commit_mutex usage in reset path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45901",
    "datePublished": "2026-05-27T12:17:09.861Z",
    "dateReserved": "2026-05-13T15:03:33.084Z",
    "dateUpdated": "2026-08-03T09:32:31.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53078 (GCVE-0-2026-53078)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-05 12:33

Title

bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. Both macros borrow a temporary register to check is_fullsock / is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with a request_sock), dst_reg should be zeroed but is not, leaving the stale ctx pointer: - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer, leading to stack-out-of-bounds access in helpers like bpf_skc_to_tcp6_sock(). - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the verifier believes is a SCALAR_VALUE, leaking a kernel pointer. Fix both macros by: - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the added instruction. - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register restore in the !fullsock path, placed after the restore because dst_reg == src_reg means we need src_reg intact to read ctx->temp.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/2a2c98141e0a75f2d…
https://git.kernel.org/stable/c/22400725de070b787…
https://git.kernel.org/stable/c/18e3ffde1822f0b48…
https://git.kernel.org/stable/c/10f86a2a5c91fc4c4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fd09af010788a884de1c39537c288830c3d305db , < 2a2c98141e0a75f2d4a7d78b0316c88b3da784ac (git) Affected: fd09af010788a884de1c39537c288830c3d305db , < 22400725de070b787cd6d806c5795370ab46d269 (git) Affected: fd09af010788a884de1c39537c288830c3d305db , < 18e3ffde1822f0b48b1753bf34aa97ce839df1d8 (git) Affected: fd09af010788a884de1c39537c288830c3d305db , < 10f86a2a5c91fc4c4d001960f1c21abe52545ef6 (git) Affected: 48be3df15aa19c04eadf156c9129293c9a10389f (git) Affected: cd4644d904e1d153d516e73e2e127e7a2fe687e1 (git) Affected: 6e0bc946cbeec538322820786b5fb5200a2216ab (git) Affected: a7e52f7f675046d9ffc5692d815fa67c82fcdbf5 (git) Affected: db7f8c57dbdd31f7e59f8dc8d1e1b38607a320ef (git) Affected: 5.7.18 , < 5.8 (semver) Affected: 5.8.4 , < 5.9 (semver) Affected: 5.4.61 , < 5.5 (semver)
Linux	Linux	Affected: 5.9 Unaffected: 0 , < 5.9 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2a2c98141e0a75f2d4a7d78b0316c88b3da784ac",
              "status": "affected",
              "version": "fd09af010788a884de1c39537c288830c3d305db",
              "versionType": "git"
            },
            {
              "lessThan": "22400725de070b787cd6d806c5795370ab46d269",
              "status": "affected",
              "version": "fd09af010788a884de1c39537c288830c3d305db",
              "versionType": "git"
            },
            {
              "lessThan": "18e3ffde1822f0b48b1753bf34aa97ce839df1d8",
              "status": "affected",
              "version": "fd09af010788a884de1c39537c288830c3d305db",
              "versionType": "git"
            },
            {
              "lessThan": "10f86a2a5c91fc4c4d001960f1c21abe52545ef6",
              "status": "affected",
              "version": "fd09af010788a884de1c39537c288830c3d305db",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "48be3df15aa19c04eadf156c9129293c9a10389f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cd4644d904e1d153d516e73e2e127e7a2fe687e1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6e0bc946cbeec538322820786b5fb5200a2216ab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a7e52f7f675046d9ffc5692d815fa67c82fcdbf5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db7f8c57dbdd31f7e59f8dc8d1e1b38607a320ef",
              "versionType": "git"
            },
            {
              "lessThan": "5.8",
              "status": "affected",
              "version": "5.7.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.4",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.61",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix same-register dst/src OOB read and pointer leak in sock_ops\n\nWhen a BPF sock_ops program accesses ctx fields with dst_reg == src_reg,\nthe SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the\ndestination register in the !fullsock / !locked_tcp_sock path.\n\nBoth macros borrow a temporary register to check is_fullsock /\nis_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the\nctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with\na request_sock), dst_reg should be zeroed but is not, leaving the stale\nctx pointer:\n\n - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks\n   as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer,\n   leading to stack-out-of-bounds access in helpers like\n   bpf_skc_to_tcp6_sock().\n\n - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the\n   verifier believes is a SCALAR_VALUE, leaking a kernel pointer.\n\nFix both macros by:\n - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the\n   added instruction.\n - Adding BPF_MOV64_IMM(si-\u003edst_reg, 0) after the temp register\n   restore in the !fullsock path, placed after the restore because\n   dst_reg == src_reg means we need src_reg intact to read ctx-\u003etemp."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires loading and attaching a crafted BPF_PROG_TYPE_SOCK_OPS program through the local bpf() interface. Remote TCP traffic can trigger an attached program, but cannot by itself create the malicious program.\nAC:L - The attacker controls the BPF bytecode pattern and can reliably trigger non-fullsock/request_sock sock_ops callbacks with local TCP activity. No uncontrolled race or rare runtime condition is required.\nPR:L - Loading/attaching sock_ops BPF requires BPF and net-admin style privileges, but these can be available to a local user through user-namespace/BPF-token delegation in plausible deployments. Under the required overestimate rule this is Low rather than High.\nUI:N - No victim action is needed after the attacker loads and attaches the crafted sock_ops program. The attacker can trigger the callback path directly.\nS:U - The impact is within the same kernel security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug leaks a kernel context pointer as a scalar and lets it be used as a bogus socket pointer. Helper dereferences can perform kernel stack out-of-bounds reads, so confidentiality impact is High.\nI:H - The bogus verifier-approved socket pointer can reach helpers that mutate socket-associated state, creating plausible kernel memory corruption from a misinterpreted stack object. With uncertainty required to resolve upward, integrity impact is High.\nA:H - The same bogus pointer path can cause kernel stack out-of-bounds accesses and invalid helper dereferences. These can crash or panic the kernel, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:11.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2a2c98141e0a75f2d4a7d78b0316c88b3da784ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/22400725de070b787cd6d806c5795370ab46d269"
        },
        {
          "url": "https://git.kernel.org/stable/c/18e3ffde1822f0b48b1753bf34aa97ce839df1d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6"
        }
      ],
      "title": "bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53078",
    "datePublished": "2026-06-24T16:30:18.858Z",
    "dateReserved": "2026-06-09T07:44:35.383Z",
    "dateUpdated": "2026-08-05T12:33:11.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53090 (GCVE-0-2026-53090)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-19 16:28

Title

bpf: Fix ld_{abs,ind} failure path analysis in subprogs

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in subprogs Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types. The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed. This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-253 - Incorrect Check of Function Return Value

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/928d354ae3557e8f7…
https://git.kernel.org/stable/c/8a800497d9f6c2ec9…
https://git.kernel.org/stable/c/de1055e7f9e67af32…
https://git.kernel.org/stable/c/37ad2bb11e9de92cb…
https://git.kernel.org/stable/c/8674e2db06cff6b50…
https://git.kernel.org/stable/c/ce01a4e5cfac7adbe…
https://git.kernel.org/stable/c/d846d83bdacbd8f14…
https://git.kernel.org/stable/c/ee861486e377edc55…
https://access.redhat.com/security/cve/CVE-2026-53090	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492305	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

7 products

Vendor	Product	Version
Linux	Linux	Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < 928d354ae3557e8f755a227e67be88034eb3cd7f (git) Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe (git) Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < de1055e7f9e67af32b1f3376066272b04e5223c0 (git) Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < 37ad2bb11e9de92cb7b94548705eeedd87f7d392 (git) Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < 8674e2db06cff6b50f2216eed9a761d15425bb34 (git) Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 (git) Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < d846d83bdacbd8f14fc45c63b8c1d22608452e1c (git) Affected: 09b28d76eac48e922dc293da1aa2b2b85c32aeee , < ee861486e377edc55361c08dcbceab3f6b6577bd (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Berkeley Packet Filter (BPF) verifier. When `ld_{abs,ind}` instructions are used in BPF subprograms, the verifier fails to correctly simulate the abnormal exit path if packet data loading fails. This oversight could lead to unexpected behavior or bypass of security checks within the BPF execution environment."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-253",
                "description": "Incorrect Check of Function Return Value",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:45:02.069Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53090"
          },
          {
            "name": "RHBZ#2492305",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492305"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53090.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: bpf: Fix ld_{abs,ind} failure path analysis in subprogs",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "928d354ae3557e8f755a227e67be88034eb3cd7f",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "de1055e7f9e67af32b1f3376066272b04e5223c0",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "37ad2bb11e9de92cb7b94548705eeedd87f7d392",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "8674e2db06cff6b50f2216eed9a761d15425bb34",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "ee861486e377edc55361c08dcbceab3f6b6577bd",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix ld_{abs,ind} failure path analysis in subprogs\n\nUsage of ld_{abs,ind} instructions got extended into subprogs some time\nago via commit 09b28d76eac4 (\"bpf: Add abnormal return checks.\"). These\nare only allowed in subprograms when the latter are BTF annotated and\nhave scalar return types.\n\nThe code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +\nexit) from legacy cBPF times. While the enforcement is on scalar return\ntypes, the verifier must also simulate the path of abnormal exit if the\npacket data load via ld_{abs,ind} failed.\n\nThis is currently not the case. Fix it by having the verifier simulate\nboth success and failure paths, and extend it in similar ways as we do\nfor tail calls. The success path (r0=unknown, continue to next insn) is\npushed onto stack for later validation and the r0=0 and return to the\ncaller is done on the fall-through side."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must locally invoke the bpf() syscall to load a crafted BPF program; packets only trigger the already-loaded malicious program path.\nAC:L - The attacker controls the BPF bytecode, BTF annotations, and packet length needed to force the ld_abs/ld_ind failure path, with no race or external timing dependency.\nPR:L - The needed subprogram/BTF path requires CAP_BPF-equivalent BPF loading privileges, but BPF tokens can delegate these checks into a user namespace. Under the higher-severity rule, this is Low rather than High.\nUI:N - No victim action is required after the local attacker loads and triggers the crafted BPF program.\nS:U - The vulnerability compromises kernel execution within the same host security authority; it is standard local kernel privilege escalation, not a VM or hardware boundary escape.\nC:H - This is a verifier bypass where an unmodeled runtime path can execute code the verifier considered unreachable, enabling unsafe register and pointer use. Such BPF verifier bypasses can be developed into arbitrary kernel memory disclosure.\nI:H - The same unverified runtime path can be shaped into unsafe memory operations, making arbitrary kernel memory write or code execution defensible.\nA:H - Even without full exploitation, executing verifier-unchecked BPF operations can crash or panic the kernel, and the attacker can repeatedly trigger the path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:06.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/928d354ae3557e8f755a227e67be88034eb3cd7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/de1055e7f9e67af32b1f3376066272b04e5223c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/37ad2bb11e9de92cb7b94548705eeedd87f7d392"
        },
        {
          "url": "https://git.kernel.org/stable/c/8674e2db06cff6b50f2216eed9a761d15425bb34"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337"
        },
        {
          "url": "https://git.kernel.org/stable/c/d846d83bdacbd8f14fc45c63b8c1d22608452e1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee861486e377edc55361c08dcbceab3f6b6577bd"
        }
      ],
      "title": "bpf: Fix ld_{abs,ind} failure path analysis in subprogs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53090",
    "datePublished": "2026-06-24T16:30:29.413Z",
    "dateReserved": "2026-06-09T07:44:35.384Z",
    "dateUpdated": "2026-08-19T16:28:06.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64205 (GCVE-0-2026-64205)

Vulnerability from cvelistv5 – Published: 2026-07-20 16:27 – Updated: 2026-08-17 04:51

Title

i2c: i801: fix hardware state machine corruption in error path

Summary

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware register cleanup in the error handling path of i801_access(). When i801_check_pre() fails (e.g., returning -EBUSY because the SMBus controller is actively used by BIOS/ACPI), the kernel does not actually acquire the hardware ownership. However, the code jumps to the 'out' label and executes: iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv)); This forcefully clears the INUSE_STS lock and resets the hardware status flags without owning the controller. Doing so interrupts ongoing BIOS/ACPI transactions and totally corrupts the SMBus hardware state machine. Consequently, all subsequent i801_access() calls fail at the pre-check stage, triggering an endless stream of "SMBus is busy, can't use it!" error logs. Over a slow serial console, this printk flood monopolizes the CPU (Console Livelock), starving other processes trying to acquire the mmap_lock down_read semaphore, ultimately triggering the hung task watchdog. Fix this by moving the 'out' label below the hardware register cleanup. If i801_check_pre() fails, we safely bypass the iowrite8() and only release the software locks (pm_runtime and mutex), strictly adhering to the rule of not releasing resources that were never acquired.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/2ef69871b313aa0f0…
https://git.kernel.org/stable/c/ef5a347532932f587…
https://git.kernel.org/stable/c/bb5133a7d5f3fe5c3…
https://git.kernel.org/stable/c/00904687b9c5527d5…
https://git.kernel.org/stable/c/10dd1a736d557e310…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1f760b87e54cf56a25ab68f8dc625e339f6e46d5 , < 2ef69871b313aa0f02182795f5e0f5aa455f203c (git) Affected: 1f760b87e54cf56a25ab68f8dc625e339f6e46d5 , < ef5a347532932f58748dad485c15039f5168c377 (git) Affected: 1f760b87e54cf56a25ab68f8dc625e339f6e46d5 , < bb5133a7d5f3fe5c387770e25f2e00e682ce11ed (git) Affected: 1f760b87e54cf56a25ab68f8dc625e339f6e46d5 , < 00904687b9c5527d569d9a1ca72119823e735a61 (git) Affected: 1f760b87e54cf56a25ab68f8dc625e339f6e46d5 , < 10dd1a736d557e310a77117832874729a0175d57 (git)
Linux	Linux	Affected: 6.3 Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-i801.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ef69871b313aa0f02182795f5e0f5aa455f203c",
              "status": "affected",
              "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
              "versionType": "git"
            },
            {
              "lessThan": "ef5a347532932f58748dad485c15039f5168c377",
              "status": "affected",
              "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
              "versionType": "git"
            },
            {
              "lessThan": "bb5133a7d5f3fe5c387770e25f2e00e682ce11ed",
              "status": "affected",
              "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
              "versionType": "git"
            },
            {
              "lessThan": "00904687b9c5527d569d9a1ca72119823e735a61",
              "status": "affected",
              "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
              "versionType": "git"
            },
            {
              "lessThan": "10dd1a736d557e310a77117832874729a0175d57",
              "status": "affected",
              "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-i801.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: fix hardware state machine corruption in error path\n\nA severe livelock and subsequent Hung Task panic were observed in the\ni2c-i801 driver during concurrent Fuzzing. The crash is caused by an\nunconditional hardware register cleanup in the error handling path of\ni801_access().\n\nWhen i801_check_pre() fails (e.g., returning -EBUSY because the SMBus\ncontroller is actively used by BIOS/ACPI), the kernel does not actually\nacquire the hardware ownership. However, the code jumps to the \u0027out\u0027\nlabel and executes:\n\n    iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv));\n\nThis forcefully clears the INUSE_STS lock and resets the hardware status\nflags without owning the controller. Doing so interrupts ongoing BIOS/ACPI\ntransactions and totally corrupts the SMBus hardware state machine.\n\nConsequently, all subsequent i801_access() calls fail at the pre-check\nstage, triggering an endless stream of \"SMBus is busy, can\u0027t use it!\"\nerror logs. Over a slow serial console, this printk flood monopolizes\nthe CPU (Console Livelock), starving other processes trying to acquire\nthe mmap_lock down_read semaphore, ultimately triggering the hung task\nwatchdog.\n\nFix this by moving the \u0027out\u0027 label below the hardware register cleanup.\nIf i801_check_pre() fails, we safely bypass the iowrite8() and only\nrelease the software locks (pm_runtime and mutex), strictly adhering to\nthe rule of not releasing resources that were never acquired."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:51.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ef69871b313aa0f02182795f5e0f5aa455f203c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef5a347532932f58748dad485c15039f5168c377"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb5133a7d5f3fe5c387770e25f2e00e682ce11ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/00904687b9c5527d569d9a1ca72119823e735a61"
        },
        {
          "url": "https://git.kernel.org/stable/c/10dd1a736d557e310a77117832874729a0175d57"
        }
      ],
      "title": "i2c: i801: fix hardware state machine corruption in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64205",
    "datePublished": "2026-07-20T16:27:53.310Z",
    "dateReserved": "2026-07-19T15:36:31.769Z",
    "dateUpdated": "2026-08-17T04:51:51.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64280 (GCVE-0-2026-64280)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52

Title

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

Summary

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large. Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/16381bda90b261a65…
https://git.kernel.org/stable/c/b50e6cd2395cde615…
https://git.kernel.org/stable/c/59070040fd12e0b78…
https://git.kernel.org/stable/c/fb2c0eab51ae5b02d…
https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < 16381bda90b261a656ded0568630c1b857b2ebc8 (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < b50e6cd2395cde615f59b624819998d28c0668d6 (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < 59070040fd12e0b78d7b4d341d9f9a183237c5ff (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231 (git) Affected: fa8dda1edef9ebc3af467c644c5533ac97171e12 , < fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27 (git)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/fpga/dfl-afu-main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "16381bda90b261a656ded0568630c1b857b2ebc8",
              "status": "affected",
              "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
              "versionType": "git"
            },
            {
              "lessThan": "b50e6cd2395cde615f59b624819998d28c0668d6",
              "status": "affected",
              "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
              "versionType": "git"
            },
            {
              "lessThan": "59070040fd12e0b78d7b4d341d9f9a183237c5ff",
              "status": "affected",
              "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
              "versionType": "git"
            },
            {
              "lessThan": "fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231",
              "status": "affected",
              "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
              "versionType": "git"
            },
            {
              "lessThan": "fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27",
              "status": "affected",
              "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/fpga/dfl-afu-main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()\n\nafu_ioctl_dma_map() accepts a 64-bit length from userspace via\nDFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value\nis passed to afu_dma_pin_pages() where npages is derived as\nlength \u003e\u003e PAGE_SHIFT and passed to pin_user_pages_fast() which takes\nint nr_pages, causing implicit truncation if length is very large.\n\nValidate map.length at the ioctl entry point before calling\nafu_dma_map_region(), rejecting values whose page count exceeds\nINT_MAX."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached locally through DFL_FPGA_PORT_DMA_MAP on a /dev/dfl-port.* character device.\nAC:L - A page-aligned length whose page count wraps to zero or a small positive integer deterministically triggers the mismatch; no race or condition outside the attacker\u2019s control is required.\nPR:L - The ioctl contains no capability or namespace privilege check, so any unprivileged user granted access to the port device can trigger it.\nUI:N - The attacker independently opens the device and submits the malicious ioctl without any victim action.\nS:C - The oversized DMA mapping can cross the IOMMU-enforced boundary between the assigned user buffer and host physical memory, affecting kernel and other-user resources.\nC:H - A small positive page-count wrap can create an enormous DMA-readable mapping after pinning only a few pages, exposing host memory beyond the authorized buffer; teardown also performs unbounded out-of-bounds pointer reads.\nI:H - The mapping is DMA_BIDIRECTIONAL, permitting writes beyond the pinned buffer, while the oversized unpin operation can corrupt unrelated page reference counts through out-of-bounds page pointers.\nA:H - A zero page-count wrap causes a deterministic pages[0] dereference from a zero-sized allocation, while other wrapped counts can produce an unbounded unpin traversal and kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:35.425Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/16381bda90b261a656ded0568630c1b857b2ebc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b50e6cd2395cde615f59b624819998d28c0668d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27"
        }
      ],
      "title": "fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64280",
    "datePublished": "2026-07-25T08:49:23.753Z",
    "dateReserved": "2026-07-19T15:36:31.777Z",
    "dateUpdated": "2026-08-17T04:52:35.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64290 (GCVE-0-2026-64290)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52

Title

iommufd: Break the loop on failure in iommufd_fault_fops_read()

Summary

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing copy_to_user() forever, spinning the reader at 100% CPU with fault->mutex held. Check rc after the inner loop and break the outer while as well.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/a38e0714affc5c0bb…
https://git.kernel.org/stable/c/5539da127d03c1f6c…
https://git.kernel.org/stable/c/f66c16b175509642e…
https://git.kernel.org/stable/c/172fc8b19825a0f58…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < a38e0714affc5c0bbb40cba5a65d6d32a5e72a71 (git) Affected: 07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < 5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8 (git) Affected: 07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < f66c16b175509642ee7082df57c9bf3deaebae1a (git) Affected: 07838f7fd529c8a6de44b601d4b7057e6c8d36ed , < 172fc8b19825a0f5884c38f2289188284e2d45ee (git)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/eventq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a38e0714affc5c0bbb40cba5a65d6d32a5e72a71",
              "status": "affected",
              "version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
              "versionType": "git"
            },
            {
              "lessThan": "5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8",
              "status": "affected",
              "version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
              "versionType": "git"
            },
            {
              "lessThan": "f66c16b175509642ee7082df57c9bf3deaebae1a",
              "status": "affected",
              "version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
              "versionType": "git"
            },
            {
              "lessThan": "172fc8b19825a0f5884c38f2289188284e2d45ee",
              "status": "affected",
              "version": "07838f7fd529c8a6de44b601d4b7057e6c8d36ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/eventq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Break the loop on failure in iommufd_fault_fops_read()\n\nOn a copy_to_user() failure inside the inner list_for_each_entry, only the\ninner loop breaks; the outer while re-fetches the just-restored fault group\nand retries the failing copy_to_user() forever, spinning the reader at 100%\nCPU with fault-\u003emutex held.\n\nCheck rc after the inner loop and break the outer while as well."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:47.176Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a38e0714affc5c0bbb40cba5a65d6d32a5e72a71"
        },
        {
          "url": "https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f66c16b175509642ee7082df57c9bf3deaebae1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/172fc8b19825a0f5884c38f2289188284e2d45ee"
        }
      ],
      "title": "iommufd: Break the loop on failure in iommufd_fault_fops_read()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64290",
    "datePublished": "2026-07-25T08:49:30.049Z",
    "dateReserved": "2026-07-19T15:36:31.778Z",
    "dateUpdated": "2026-08-17T04:52:47.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64561 (GCVE-0-2026-64561)

Vulnerability from cvelistv5 – Published: 2026-08-04 06:23 – Updated: 2026-08-19 16:28

Title

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/65c4f7a1028cf01a9…
https://git.kernel.org/stable/c/35e77467610c4a37c…
https://git.kernel.org/stable/c/0026dbb7de8ea76e9…
https://git.kernel.org/stable/c/f3477a6a4164f1528…
https://git.kernel.org/stable/c/bce0d3c26e2c761a4…
https://git.kernel.org/stable/c/2abd5287f08319fa3…
https://github.com/V4bel/Zapscape

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f95eec9bed76d42194c23153cb1cc8f186bf91cb , < 65c4f7a1028cf01a93a2762d679c289810ede990 (git) Affected: f95eec9bed76d42194c23153cb1cc8f186bf91cb , < 35e77467610c4a37cb0ff54ee56b85f73b1f5700 (git) Affected: f95eec9bed76d42194c23153cb1cc8f186bf91cb , < 0026dbb7de8ea76e97d6edf42fc3cc084564e2bf (git) Affected: f95eec9bed76d42194c23153cb1cc8f186bf91cb , < f3477a6a4164f15287444eda685b5f6405dbd1e5 (git) Affected: f95eec9bed76d42194c23153cb1cc8f186bf91cb , < bce0d3c26e2c761a4bf43c8949f333fc7374eb2d (git) Affected: f95eec9bed76d42194c23153cb1cc8f186bf91cb , < 2abd5287f08319fa35764566b15c6e22cb1068db (git)
Linux	Linux	Affected: 5.9 Unaffected: 0 , < 5.9 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c",
            "arch/x86/kvm/mmu/paging_tmpl.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "65c4f7a1028cf01a93a2762d679c289810ede990",
              "status": "affected",
              "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
              "versionType": "git"
            },
            {
              "lessThan": "35e77467610c4a37cb0ff54ee56b85f73b1f5700",
              "status": "affected",
              "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
              "versionType": "git"
            },
            {
              "lessThan": "0026dbb7de8ea76e97d6edf42fc3cc084564e2bf",
              "status": "affected",
              "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
              "versionType": "git"
            },
            {
              "lessThan": "f3477a6a4164f15287444eda685b5f6405dbd1e5",
              "status": "affected",
              "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
              "versionType": "git"
            },
            {
              "lessThan": "bce0d3c26e2c761a4bf43c8949f333fc7374eb2d",
              "status": "affected",
              "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
              "versionType": "git"
            },
            {
              "lessThan": "2abd5287f08319fa35764566b15c6e22cb1068db",
              "status": "affected",
              "version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c",
            "arch/x86/kvm/mmu/paging_tmpl.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU.  If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root.  On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent\u0027s role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM\u0027s invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can\u0027t be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:30.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990"
        },
        {
          "url": "https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700"
        },
        {
          "url": "https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db"
        },
        {
          "url": "https://github.com/V4bel/Zapscape"
        }
      ],
      "title": "KVM: x86: Check for invalid/obsolete root *after* making MMU pages available",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64561",
    "datePublished": "2026-08-04T06:23:21.094Z",
    "dateReserved": "2026-07-19T15:36:31.796Z",
    "dateUpdated": "2026-08-19T16:28:30.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64562 (GCVE-0-2026-64562)

Vulnerability from cvelistv5 – Published: 2026-08-04 06:23 – Updated: 2026-08-19 16:28

Title

KVM: nVMX: Hide shadow VMCS right after VMCLEAR

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR. The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/b82c3144d82642654…
https://git.kernel.org/stable/c/4f50e6aec16f69627…
https://git.kernel.org/stable/c/dc3eecfa219ebc9d0…
https://git.kernel.org/stable/c/af56298e9d86e6098…
https://git.kernel.org/stable/c/589419470030a89f1…
https://git.kernel.org/stable/c/8001d2ce9d9bd0911…
https://git.kernel.org/stable/c/1dabef6e206568bf9…
https://git.kernel.org/stable/c/622ebfac01ba4f9c0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < b82c3144d8264265448292ca406f60bafeba3b6f (git) Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < 4f50e6aec16f69627dbad5704d1e90a255d766a7 (git) Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < dc3eecfa219ebc9d01eaf7d1abd1441efe884dab (git) Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < af56298e9d86e6098cd1d2e155cb2949b7c45412 (git) Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < 589419470030a89f16cf19300658b6dc644ca946 (git) Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < 8001d2ce9d9bd09118ce523aef595aa094573ae3 (git) Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < 1dabef6e206568bf9d9ade74f6e56a48ea35695d (git) Affected: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 , < 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 (git)
Linux	Linux	Affected: 4.9 Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b82c3144d8264265448292ca406f60bafeba3b6f",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            },
            {
              "lessThan": "4f50e6aec16f69627dbad5704d1e90a255d766a7",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            },
            {
              "lessThan": "dc3eecfa219ebc9d01eaf7d1abd1441efe884dab",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            },
            {
              "lessThan": "af56298e9d86e6098cd1d2e155cb2949b7c45412",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            },
            {
              "lessThan": "589419470030a89f16cf19300658b6dc644ca946",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            },
            {
              "lessThan": "8001d2ce9d9bd09118ce523aef595aa094573ae3",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            },
            {
              "lessThan": "1dabef6e206568bf9d9ade74f6e56a48ea35695d",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            },
            {
              "lessThan": "622ebfac01ba4f9c0060cebd41257fe46fc4a0b3",
              "status": "affected",
              "version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/vmx/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Hide shadow VMCS right after VMCLEAR\n\nfree_nested() frees the shadow VMCS while vmcs01 still points to it. But\nbecause it is asynchronous with respect to loaded_vmcs_clear(), the vCPU\nmight migrate before the pointer is cleared and __loaded_vmcs_clear()\nmay then execute VMCLEAR.\n\nThe VMCS needs to stay attached until its explicit VMCLEAR completes, but\nthen it can be hidden and the page safely freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:32.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab"
        },
        {
          "url": "https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412"
        },
        {
          "url": "https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946"
        },
        {
          "url": "https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d"
        },
        {
          "url": "https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3"
        }
      ],
      "title": "KVM: nVMX: Hide shadow VMCS right after VMCLEAR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64562",
    "datePublished": "2026-08-04T06:23:21.855Z",
    "dateReserved": "2026-07-19T15:36:31.796Z",
    "dateUpdated": "2026-08-19T16:28:32.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CERTFR-2026-AVI-1069

Solutions

CVE-2025-40098 (GCVE-0-2025-40098)

CVE-2026-45897 (GCVE-0-2026-45897)

CVE-2026-45901 (GCVE-0-2026-45901)

CVE-2026-53078 (GCVE-0-2026-53078)

CVE-2026-53090 (GCVE-0-2026-53090)

CVE-2026-64205 (GCVE-0-2026-64205)

CVE-2026-64280 (GCVE-0-2026-64280)

CVE-2026-64290 (GCVE-0-2026-64290)

CVE-2026-64561 (GCVE-0-2026-64561)

CVE-2026-64562 (GCVE-0-2026-64562)

Tags

Sightings

Nomenclature