Vulnerability-Lookup

OPENSUSE-SU-2026:11175-1

Vulnerability from csaf_opensuse - Published: 2026-07-02 00:00 - Updated: 2026-09-16 21:19

Summary

kernel-devel-7.1.2-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: kernel-devel-7.1.2-1.1 on GA media

Description of the patch: These are all security issues fixed in the kernel-devel-7.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11175

CVE-2026-45866

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-52946

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-45866

Threats

Impact moderate

CVE-2026-53325

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-45866

Threats

Impact moderate

CVE-2026-53354

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-45866

Threats

Impact important

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-45866/	self
https://www.suse.com/security/cve/CVE-2026-52946/	self
https://www.suse.com/security/cve/CVE-2026-53325/	self
https://www.suse.com/security/cve/CVE-2026-53354/	self
https://www.suse.com/security/cve/CVE-2026-45866	external
https://bugzilla.suse.com/1266716	external
https://bugzilla.suse.com/1266725	external
https://www.suse.com/security/cve/CVE-2026-52946	external
https://bugzilla.suse.com/1269113	external
https://www.suse.com/security/cve/CVE-2026-53325	external
https://bugzilla.suse.com/1269726	external
https://www.suse.com/security/cve/CVE-2026-53354	external
https://bugzilla.suse.com/1270230	external
https://bugzilla.suse.com/1270369	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "kernel-devel-7.1.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the kernel-devel-7.1.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11175",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11175-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-45866 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-45866/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-52946 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-52946/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53325 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53325/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53354 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53354/"
      }
    ],
    "title": "kernel-devel-7.1.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-16T21:19:39Z",
      "generator": {
        "date": "2026-07-02T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11175-1",
      "initial_release_date": "2026-07-02T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-07-02T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:17:09Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:19:39Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-7.1.2-1.1.aarch64",
                "product": {
                  "name": "kernel-devel-7.1.2-1.1.aarch64",
                  "product_id": "kernel-devel-7.1.2-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@7.1.2-1.1?arch=aarch64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-macros-7.1.2-1.1.aarch64",
                "product": {
                  "name": "kernel-macros-7.1.2-1.1.aarch64",
                  "product_id": "kernel-macros-7.1.2-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-macros@7.1.2-1.1?arch=aarch64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-7.1.2-1.1.aarch64",
                "product": {
                  "name": "kernel-source-7.1.2-1.1.aarch64",
                  "product_id": "kernel-source-7.1.2-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source@7.1.2-1.1?arch=aarch64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-vanilla-7.1.2-1.1.aarch64",
                "product": {
                  "name": "kernel-source-vanilla-7.1.2-1.1.aarch64",
                  "product_id": "kernel-source-vanilla-7.1.2-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source-vanilla@7.1.2-1.1?arch=aarch64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-7.1.2-1.1.ppc64le",
                "product": {
                  "name": "kernel-devel-7.1.2-1.1.ppc64le",
                  "product_id": "kernel-devel-7.1.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@7.1.2-1.1?arch=ppc64le\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-macros-7.1.2-1.1.ppc64le",
                "product": {
                  "name": "kernel-macros-7.1.2-1.1.ppc64le",
                  "product_id": "kernel-macros-7.1.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-macros@7.1.2-1.1?arch=ppc64le\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-7.1.2-1.1.ppc64le",
                "product": {
                  "name": "kernel-source-7.1.2-1.1.ppc64le",
                  "product_id": "kernel-source-7.1.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source@7.1.2-1.1?arch=ppc64le\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-vanilla-7.1.2-1.1.ppc64le",
                "product": {
                  "name": "kernel-source-vanilla-7.1.2-1.1.ppc64le",
                  "product_id": "kernel-source-vanilla-7.1.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source-vanilla@7.1.2-1.1?arch=ppc64le\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-7.1.2-1.1.s390x",
                "product": {
                  "name": "kernel-devel-7.1.2-1.1.s390x",
                  "product_id": "kernel-devel-7.1.2-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@7.1.2-1.1?arch=s390x\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-macros-7.1.2-1.1.s390x",
                "product": {
                  "name": "kernel-macros-7.1.2-1.1.s390x",
                  "product_id": "kernel-macros-7.1.2-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-macros@7.1.2-1.1?arch=s390x\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-7.1.2-1.1.s390x",
                "product": {
                  "name": "kernel-source-7.1.2-1.1.s390x",
                  "product_id": "kernel-source-7.1.2-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source@7.1.2-1.1?arch=s390x\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-vanilla-7.1.2-1.1.s390x",
                "product": {
                  "name": "kernel-source-vanilla-7.1.2-1.1.s390x",
                  "product_id": "kernel-source-vanilla-7.1.2-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source-vanilla@7.1.2-1.1?arch=s390x\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-7.1.2-1.1.x86_64",
                "product": {
                  "name": "kernel-devel-7.1.2-1.1.x86_64",
                  "product_id": "kernel-devel-7.1.2-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@7.1.2-1.1?arch=x86_64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-macros-7.1.2-1.1.x86_64",
                "product": {
                  "name": "kernel-macros-7.1.2-1.1.x86_64",
                  "product_id": "kernel-macros-7.1.2-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-macros@7.1.2-1.1?arch=x86_64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-7.1.2-1.1.x86_64",
                "product": {
                  "name": "kernel-source-7.1.2-1.1.x86_64",
                  "product_id": "kernel-source-7.1.2-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source@7.1.2-1.1?arch=x86_64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-vanilla-7.1.2-1.1.x86_64",
                "product": {
                  "name": "kernel-source-vanilla-7.1.2-1.1.x86_64",
                  "product_id": "kernel-source-vanilla-7.1.2-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:7.1.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-source-vanilla@7.1.2-1.1?arch=x86_64\u0026upstream=kernel-source-7.1.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-7.1.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64"
        },
        "product_reference": "kernel-devel-7.1.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-7.1.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le"
        },
        "product_reference": "kernel-devel-7.1.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-7.1.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x"
        },
        "product_reference": "kernel-devel-7.1.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-7.1.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64"
        },
        "product_reference": "kernel-devel-7.1.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-macros-7.1.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64"
        },
        "product_reference": "kernel-macros-7.1.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-macros-7.1.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le"
        },
        "product_reference": "kernel-macros-7.1.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-macros-7.1.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x"
        },
        "product_reference": "kernel-macros-7.1.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-macros-7.1.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64"
        },
        "product_reference": "kernel-macros-7.1.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-7.1.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64"
        },
        "product_reference": "kernel-source-7.1.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-7.1.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le"
        },
        "product_reference": "kernel-source-7.1.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-7.1.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x"
        },
        "product_reference": "kernel-source-7.1.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-7.1.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64"
        },
        "product_reference": "kernel-source-7.1.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-vanilla-7.1.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64"
        },
        "product_reference": "kernel-source-vanilla-7.1.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-vanilla-7.1.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le"
        },
        "product_reference": "kernel-source-vanilla-7.1.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-vanilla-7.1.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x"
        },
        "product_reference": "kernel-source-vanilla-7.1.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-vanilla-7.1.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
        },
        "product_reference": "kernel-source-vanilla-7.1.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-45866",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-45866"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: caif: fix use-after-free in caif_serial ldisc_close()\n\nThere is a use-after-free bug in caif_serial where handle_tx() may\naccess ser-\u003etty after the tty has been freed.\n\nThe race condition occurs between ldisc_close() and packet transmission:\n\n    CPU 0 (close)                     CPU 1 (xmit)\n    -------------                     ------------\n    ldisc_close()\n      tty_kref_put(ser-\u003etty)\n      [tty may be freed here]\n                     \u003c-- race window --\u003e\n                                      caif_xmit()\n                                        handle_tx()\n                                          tty = ser-\u003etty  // dangling ptr\n                                          tty-\u003eops-\u003ewrite() // UAF!\n      schedule_work()\n        ser_release()\n          unregister_netdevice()\n\nThe root cause is that tty_kref_put() is called in ldisc_close() while\nthe network device is still active and can receive packets.\n\nSince ser and tty have a 1:1 binding relationship with consistent\nlifecycles (ser is allocated in ldisc_open and freed in ser_release\nvia unregister_netdevice, and each ser binds exactly one tty), we can\nsafely defer the tty reference release to ser_release() where the\nnetwork device is unregistered.\n\nFix this by moving tty_kref_put() from ldisc_close() to ser_release(),\nafter unregister_netdevice(). This ensures the tty reference is held\nas long as the network device exists, preventing the UAF.\n\nNote: We save ser-\u003etty before unregister_netdevice() because ser is\nembedded in netdev\u0027s private data and will be freed along with netdev\n(needs_free_netdev = true).\n\nHow to reproduce: Add mdelay(500) at the beginning of ldisc_close()\nto widen the race window, then run the reproducer program [1].\n\nNote: There is a separate deadloop issue in handle_tx() when using\nPORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper\nserial backend). This deadloop exists even without this patch,\nand is likely caused by inconsistency between uart_write_room() and\nuart_write() in serial core. It has been addressed in a separate\npatch [2].\n\nKASAN report:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620\nRead of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x10e/0x1f0\n print_report+0xd0/0x630\n kasan_report+0xe4/0x120\n handle_tx+0x5d1/0x620\n dev_hard_start_xmit+0x9d/0x6c0\n __dev_queue_xmit+0x6e2/0x4410\n packet_xmit+0x243/0x360\n packet_sendmsg+0x26cf/0x5500\n __sys_sendto+0x4a3/0x520\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0xc9/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f615df2c0d7\n\nAllocated by task 9930:\n\nFreed by task 64:\n\nLast potentially related work creation:\n\nThe buggy address belongs to the object at ffff8881131e1000\n which belongs to the cache kmalloc-cg-2k of size 2048\nThe buggy address is located 1168 bytes inside of\n freed 2048-byte region [ffff8881131e1000, ffff8881131e1800)\n\nThe buggy address belongs to the physical page:\npage_owner tracks the page as allocated\npage last free pid 9778 tgid 9778 stack trace:\n\nMemory state around the buggy address:\n ffff8881131e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff8881131e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                         ^\n ffff8881131e1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n[1]: https://gist.github.com/mrpre/f683f244544f7b11e7fa87df9e6c2eeb\n[2]: https://lore.kernel.org/linux-serial/20260204074327.226165-1-jiayuan.chen@linux.dev/T/#u",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-45866",
          "url": "https://www.suse.com/security/cve/CVE-2026-45866"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266716 for CVE-2026-45866",
          "url": "https://bugzilla.suse.com/1266716"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266725 for CVE-2026-45866",
          "url": "https://bugzilla.suse.com/1266725"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-45866"
    },
    {
      "cve": "CVE-2026-52946",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-52946"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling\n\nA SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in\nsend_sigio() and send_sigurg() when a process group receives a signal.\n\nWhen FASYNC is configured for a process group (PIDTYPE_PGID), both\nfunctions use read_lock(\u0026tasklist_lock) to traverse the task list.\nHowever, they are frequently called from softirq context:\n- send_sigio() via input_inject_event -\u003e kill_fasync\n- send_sigurg() via tcp_check_urg -\u003e sk_send_sigurg (NET_RX_SOFTIRQ)\n\nThe deadlock is caused by the rwlock writer fairness mechanism:\n1. CPU 0 (process context) holds read_lock(\u0026tasklist_lock) in do_wait().\n2. CPU 1 (process context) attempts write_lock(\u0026tasklist_lock) in\n   fork() or exit() and spins, which blocks all new readers.\n3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception).\n4. The softirq calls send_sigurg() and attempts to acquire\n   read_lock(\u0026tasklist_lock), deadlocking because CPU 1 is waiting.\n\nSince PID hashing and do_each_pid_task() traversals are already\nRCU-protected, the read_lock on tasklist_lock is no longer strictly\nrequired for safe traversal. Fix this by replacing tasklist_lock with\nrcu_read_lock(), aligning the process group signaling path with the\nsingle-PID path. This also mitigates a potential remote denial of\nservice vector via TCP URG packets.\n\nLockdep splat:\n=====================================================\nWARNING: SOFTIRQ-safe -\u003e SOFTIRQ-unsafe lock order detected\n[...]\nChain exists of:\n  \u0026dev-\u003eevent_lock --\u003e \u0026f_owner-\u003elock --\u003e tasklist_lock\n\nPossible interrupt unsafe locking scenario:\n       CPU0                    CPU1\n       ----                    ----\n  lock(tasklist_lock);\n                           local_irq_disable();\n                           lock(\u0026dev-\u003eevent_lock);\n                           lock(\u0026f_owner-\u003elock);\n  \u003cInterrupt\u003e\n    lock(\u0026dev-\u003eevent_lock);\n\n*** DEADLOCK ***",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-52946",
          "url": "https://www.suse.com/security/cve/CVE-2026-52946"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269113 for CVE-2026-52946",
          "url": "https://bugzilla.suse.com/1269113"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-52946"
    },
    {
      "cve": "CVE-2026-53325",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53325"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nagp/amd64: Fix broken error propagation in agp_amd64_probe()\n\nA NULL pointer dereference was observed in the AMD64 AGP driver when\nrunning in a virtualized environment (e.g. qemu/kvm) without a physical\nAMD northbridge. The crash occurs in amd64_fetch_size() when attempting\nto dereference the pointer returned by node_to_amd_nb(0).\n\nThe root cause of this crash is broken error propagation in\nagp_amd64_probe(): When no AMD northbridges are found, cache_nbs()\ncorrectly returns -ENODEV. However, the probe function erroneously\nchecks the return value against exactly -1, rather than \u003c 0.\n\nAs a result, the hardware absence error is masked, allowing the driver\nto improperly proceed with initialization. It eventually calls\nagp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware\ndoes not exist, node_to_amd_nb(0) returns NULL, leading to a General\nProtection Fault (GPF) when accessing its -\u003emisc member.\n\nFix the issue by correcting the error check in agp_amd64_probe() to\nabort properly when cache_nbs() returns any negative error code. This\nprevents the driver from erroneously proceeding without hardware, thereby\navoiding the subsequent NULL pointer dereference at its source.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53325",
          "url": "https://www.suse.com/security/cve/CVE-2026-53325"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269726 for CVE-2026-53325",
          "url": "https://bugzilla.suse.com/1269726"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-53325"
    },
    {
      "cve": "CVE-2026-53354",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53354"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: errata: Mitigate TLBI errata on various Arm CPUs\n\nA number of CPUs developed by Arm suffer from errata whereby a broadcast\nTLBI;DSB sequence may complete before the global observation of writes\nwhich are translated by an affected TLB entry.\n\nThese errata ONLY affect the completion of memory accesses which have\nbeen translated by an invalidated TLB entry, and these errata DO NOT\naffect the actual invalidation of TLB entries. TLB entries are removed\ncorrectly.\n\nThis issue has been assigned CVE ID CVE-2025-10263.\n\nTo mitigate this issue, Arm recommends that software follows any\naffected TLBI;DSB sequence with an additional TLBI;DSB, which will\nensure that all memory write effects affected by the first TLBI have\nbeen globally observed. The additional TLBI can use any operation that\nis broadcast to affected CPUs, and the additional DSB can use any option\nthat is sufficient to complete the additional TLBI.\n\nThe ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate\nthe issue. Enable this workaround for affected CPUs, and update the\nsilicon errata documentation accordingly.\n\nNote that due to the manner in which Arm develops IP and tracks errata,\nsome CPUs share a common erratum number.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
          "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53354",
          "url": "https://www.suse.com/security/cve/CVE-2026-53354"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270230 for CVE-2026-53354",
          "url": "https://bugzilla.suse.com/1270230"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270369 for CVE-2026-53354",
          "url": "https://bugzilla.suse.com/1270369"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-devel-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-macros-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-7.1.2-1.1.x86_64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.aarch64",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.ppc64le",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.s390x",
            "openSUSE Tumbleweed:kernel-source-vanilla-7.1.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-53354"
    }
  ]
}

CVE-2026-45866 (GCVE-0-2026-45866)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:15 – Updated: 2026-05-27 12:15

Title

serial: caif: fix use-after-free in caif_serial ldisc_close()

Summary

In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free bug in caif_serial where handle_tx() may access ser->tty after the tty has been freed. The race condition occurs between ldisc_close() and packet transmission: CPU 0 (close) CPU 1 (xmit) ------------- ------------ ldisc_close() tty_kref_put(ser->tty) [tty may be freed here] <-- race window --> caif_xmit() handle_tx() tty = ser->tty // dangling ptr tty->ops->write() // UAF! schedule_work() ser_release() unregister_netdevice() The root cause is that tty_kref_put() is called in ldisc_close() while the network device is still active and can receive packets. Since ser and tty have a 1:1 binding relationship with consistent lifecycles (ser is allocated in ldisc_open and freed in ser_release via unregister_netdevice, and each ser binds exactly one tty), we can safely defer the tty reference release to ser_release() where the network device is unregistered. Fix this by moving tty_kref_put() from ldisc_close() to ser_release(), after unregister_netdevice(). This ensures the tty reference is held as long as the network device exists, preventing the UAF. Note: We save ser->tty before unregister_netdevice() because ser is embedded in netdev's private data and will be freed along with netdev (needs_free_netdev = true). How to reproduce: Add mdelay(500) at the beginning of ldisc_close() to widen the race window, then run the reproducer program [1]. Note: There is a separate deadloop issue in handle_tx() when using PORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper serial backend). This deadloop exists even without this patch, and is likely caused by inconsistency between uart_write_room() and uart_write() in serial core. It has been addressed in a separate patch [2]. KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620 Read of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929 Call Trace: <TASK> dump_stack_lvl+0x10e/0x1f0 print_report+0xd0/0x630 kasan_report+0xe4/0x120 handle_tx+0x5d1/0x620 dev_hard_start_xmit+0x9d/0x6c0 __dev_queue_xmit+0x6e2/0x4410 packet_xmit+0x243/0x360 packet_sendmsg+0x26cf/0x5500 __sys_sendto+0x4a3/0x520 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0xc9/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f615df2c0d7 Allocated by task 9930: Freed by task 64: Last potentially related work creation: The buggy address belongs to the object at ffff8881131e1000 which belongs to the cache kmalloc-cg-2k of size 2048 The buggy address is located 1168 bytes inside of freed 2048-byte region [ffff8881131e1000, ffff8881131e1800) The buggy address belongs to the physical page: page_owner tracks the page as allocated page last free pid 9778 tgid 9778 stack trace: Memory state around the buggy address: ffff8881131e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881131e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8881131e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881131e1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881131e1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [1]: https://gist.github.com/mrpre/f683f244544f7b11e7fa87df9e6c2eeb [2]: https://lore.kernel.org/linux-serial/20260204074327.226165-1-jiayuan.chen@linux.dev/T/#u

Severity

No CVSS data available.

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/5e266ba8d330d3b8e…
https://git.kernel.org/stable/c/d3c75db4e0460641d…
https://git.kernel.org/stable/c/4e63d6f68544ae526…
https://git.kernel.org/stable/c/331e2b7051635780e…
https://git.kernel.org/stable/c/52731ef4438155cea…
https://git.kernel.org/stable/c/c8c197aaa56b25a2d…
https://git.kernel.org/stable/c/40962f2bf8cdba63a…
https://git.kernel.org/stable/c/308e7e4d0a8463596…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < 5e266ba8d330d3b8e5bc198f238cd8901826cfa1 (git) Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < d3c75db4e0460641dbcd274b40867e252d801da1 (git) Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < 4e63d6f68544ae5269ac9735ae5b69b59b5b8725 (git) Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < 331e2b7051635780edea248dd08ae2026c126f4a (git) Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < 52731ef4438155cea782fac74e547a327ab9e7c5 (git) Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < c8c197aaa56b25a2d54f3aa07e27e228d6c08546 (git) Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < 40962f2bf8cdba63af23aec95ad3f49b689e58e2 (git) Affected: 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf , < 308e7e4d0a846359685f40aade023aee7b27284c (git)
Linux	Linux	Affected: 3.11 Unaffected: 0 , < 3.11 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/caif/caif_serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e266ba8d330d3b8e5bc198f238cd8901826cfa1",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            },
            {
              "lessThan": "d3c75db4e0460641dbcd274b40867e252d801da1",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            },
            {
              "lessThan": "4e63d6f68544ae5269ac9735ae5b69b59b5b8725",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            },
            {
              "lessThan": "331e2b7051635780edea248dd08ae2026c126f4a",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            },
            {
              "lessThan": "52731ef4438155cea782fac74e547a327ab9e7c5",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            },
            {
              "lessThan": "c8c197aaa56b25a2d54f3aa07e27e228d6c08546",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            },
            {
              "lessThan": "40962f2bf8cdba63af23aec95ad3f49b689e58e2",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            },
            {
              "lessThan": "308e7e4d0a846359685f40aade023aee7b27284c",
              "status": "affected",
              "version": "56e0ef527b184b3de2d7f88c6190812b2b2ac6bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/caif/caif_serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: caif: fix use-after-free in caif_serial ldisc_close()\n\nThere is a use-after-free bug in caif_serial where handle_tx() may\naccess ser-\u003etty after the tty has been freed.\n\nThe race condition occurs between ldisc_close() and packet transmission:\n\n    CPU 0 (close)                     CPU 1 (xmit)\n    -------------                     ------------\n    ldisc_close()\n      tty_kref_put(ser-\u003etty)\n      [tty may be freed here]\n                     \u003c-- race window --\u003e\n                                      caif_xmit()\n                                        handle_tx()\n                                          tty = ser-\u003etty  // dangling ptr\n                                          tty-\u003eops-\u003ewrite() // UAF!\n      schedule_work()\n        ser_release()\n          unregister_netdevice()\n\nThe root cause is that tty_kref_put() is called in ldisc_close() while\nthe network device is still active and can receive packets.\n\nSince ser and tty have a 1:1 binding relationship with consistent\nlifecycles (ser is allocated in ldisc_open and freed in ser_release\nvia unregister_netdevice, and each ser binds exactly one tty), we can\nsafely defer the tty reference release to ser_release() where the\nnetwork device is unregistered.\n\nFix this by moving tty_kref_put() from ldisc_close() to ser_release(),\nafter unregister_netdevice(). This ensures the tty reference is held\nas long as the network device exists, preventing the UAF.\n\nNote: We save ser-\u003etty before unregister_netdevice() because ser is\nembedded in netdev\u0027s private data and will be freed along with netdev\n(needs_free_netdev = true).\n\nHow to reproduce: Add mdelay(500) at the beginning of ldisc_close()\nto widen the race window, then run the reproducer program [1].\n\nNote: There is a separate deadloop issue in handle_tx() when using\nPORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper\nserial backend). This deadloop exists even without this patch,\nand is likely caused by inconsistency between uart_write_room() and\nuart_write() in serial core. It has been addressed in a separate\npatch [2].\n\nKASAN report:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620\nRead of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x10e/0x1f0\n print_report+0xd0/0x630\n kasan_report+0xe4/0x120\n handle_tx+0x5d1/0x620\n dev_hard_start_xmit+0x9d/0x6c0\n __dev_queue_xmit+0x6e2/0x4410\n packet_xmit+0x243/0x360\n packet_sendmsg+0x26cf/0x5500\n __sys_sendto+0x4a3/0x520\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0xc9/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f615df2c0d7\n\nAllocated by task 9930:\n\nFreed by task 64:\n\nLast potentially related work creation:\n\nThe buggy address belongs to the object at ffff8881131e1000\n which belongs to the cache kmalloc-cg-2k of size 2048\nThe buggy address is located 1168 bytes inside of\n freed 2048-byte region [ffff8881131e1000, ffff8881131e1800)\n\nThe buggy address belongs to the physical page:\npage_owner tracks the page as allocated\npage last free pid 9778 tgid 9778 stack trace:\n\nMemory state around the buggy address:\n ffff8881131e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff8881131e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                         ^\n ffff8881131e1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n[1]: https://gist.github.com/mrpre/f683f244544f7b11e7fa87df9e6c2eeb\n[2]: https://lore.kernel.org/linux-serial/20260204074327.226165-1-jiayuan.chen@linux.dev/T/#u"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:15:46.135Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e266ba8d330d3b8e5bc198f238cd8901826cfa1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3c75db4e0460641dbcd274b40867e252d801da1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e63d6f68544ae5269ac9735ae5b69b59b5b8725"
        },
        {
          "url": "https://git.kernel.org/stable/c/331e2b7051635780edea248dd08ae2026c126f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/52731ef4438155cea782fac74e547a327ab9e7c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8c197aaa56b25a2d54f3aa07e27e228d6c08546"
        },
        {
          "url": "https://git.kernel.org/stable/c/40962f2bf8cdba63af23aec95ad3f49b689e58e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/308e7e4d0a846359685f40aade023aee7b27284c"
        }
      ],
      "title": "serial: caif: fix use-after-free in caif_serial ldisc_close()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45866",
    "datePublished": "2026-05-27T12:15:46.135Z",
    "dateReserved": "2026-05-13T15:03:33.080Z",
    "dateUpdated": "2026-05-27T12:15:46.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52946 (GCVE-0-2026-52946)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:26 – Updated: 2026-09-08 08:49

Title

fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

Summary

In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a signal. When FASYNC is configured for a process group (PIDTYPE_PGID), both functions use read_lock(&tasklist_lock) to traverse the task list. However, they are frequently called from softirq context: - send_sigio() via input_inject_event -> kill_fasync - send_sigurg() via tcp_check_urg -> sk_send_sigurg (NET_RX_SOFTIRQ) The deadlock is caused by the rwlock writer fairness mechanism: 1. CPU 0 (process context) holds read_lock(&tasklist_lock) in do_wait(). 2. CPU 1 (process context) attempts write_lock(&tasklist_lock) in fork() or exit() and spins, which blocks all new readers. 3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception). 4. The softirq calls send_sigurg() and attempts to acquire read_lock(&tasklist_lock), deadlocking because CPU 1 is waiting. Since PID hashing and do_each_pid_task() traversals are already RCU-protected, the read_lock on tasklist_lock is no longer strictly required for safe traversal. Fix this by replacing tasklist_lock with rcu_read_lock(), aligning the process group signaling path with the single-PID path. This also mitigates a potential remote denial of service vector via TCP URG packets. Lockdep splat: ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [...] Chain exists of: &dev->event_lock --> &f_owner->lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock); lock(&f_owner->lock); <Interrupt> lock(&dev->event_lock); *** DEADLOCK ***

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/54626335ea4174ab2…
https://git.kernel.org/stable/c/897d6a7247739fb15…
https://git.kernel.org/stable/c/32dbd5ce4be3a3ed7…
https://git.kernel.org/stable/c/b5fa9e32fb6718f70…
https://git.kernel.org/stable/c/1bee417678f1135e3…
https://git.kernel.org/stable/c/20a93e397abe850c4…
https://git.kernel.org/stable/c/bfcc8e8d8a495bb34…
https://git.kernel.org/stable/c/36c1b57b2ecf3c61a…
https://git.kernel.org/stable/c/00633c4683828acd5…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 54626335ea4174ab2d9a183b511d825f6765e47b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 897d6a7247739fb1528f98c575df4f2e5de7f994 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b5fa9e32fb6718f70c986ee14dd5d01b4846f331 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1bee417678f1135e35b25a37734db46aa94258d2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 20a93e397abe850c49b6fa0e8cc827b5f634a8f5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bfcc8e8d8a495bb34cae9e620adfb75fb13a3954 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 00633c4683828acd5256fa8d5163f440d74bbe71 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1.1 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:46.963Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fcntl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "54626335ea4174ab2d9a183b511d825f6765e47b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "897d6a7247739fb1528f98c575df4f2e5de7f994",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b5fa9e32fb6718f70c986ee14dd5d01b4846f331",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1bee417678f1135e35b25a37734db46aa94258d2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "20a93e397abe850c49b6fa0e8cc827b5f634a8f5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bfcc8e8d8a495bb34cae9e620adfb75fb13a3954",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "00633c4683828acd5256fa8d5163f440d74bbe71",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fcntl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling\n\nA SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in\nsend_sigio() and send_sigurg() when a process group receives a signal.\n\nWhen FASYNC is configured for a process group (PIDTYPE_PGID), both\nfunctions use read_lock(\u0026tasklist_lock) to traverse the task list.\nHowever, they are frequently called from softirq context:\n- send_sigio() via input_inject_event -\u003e kill_fasync\n- send_sigurg() via tcp_check_urg -\u003e sk_send_sigurg (NET_RX_SOFTIRQ)\n\nThe deadlock is caused by the rwlock writer fairness mechanism:\n1. CPU 0 (process context) holds read_lock(\u0026tasklist_lock) in do_wait().\n2. CPU 1 (process context) attempts write_lock(\u0026tasklist_lock) in\n   fork() or exit() and spins, which blocks all new readers.\n3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception).\n4. The softirq calls send_sigurg() and attempts to acquire\n   read_lock(\u0026tasklist_lock), deadlocking because CPU 1 is waiting.\n\nSince PID hashing and do_each_pid_task() traversals are already\nRCU-protected, the read_lock on tasklist_lock is no longer strictly\nrequired for safe traversal. Fix this by replacing tasklist_lock with\nrcu_read_lock(), aligning the process group signaling path with the\nsingle-PID path. This also mitigates a potential remote denial of\nservice vector via TCP URG packets.\n\nLockdep splat:\n=====================================================\nWARNING: SOFTIRQ-safe -\u003e SOFTIRQ-unsafe lock order detected\n[...]\nChain exists of:\n  \u0026dev-\u003eevent_lock --\u003e \u0026f_owner-\u003elock --\u003e tasklist_lock\n\nPossible interrupt unsafe locking scenario:\n       CPU0                    CPU1\n       ----                    ----\n  lock(tasklist_lock);\n                           local_irq_disable();\n                           lock(\u0026dev-\u003eevent_lock);\n                           lock(\u0026f_owner-\u003elock);\n  \u003cInterrupt\u003e\n    lock(\u0026dev-\u003eevent_lock);\n\n*** DEADLOCK ***"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote TCP peer can reach tcp_check_urg()-\u003esk_send_sigurg()-\u003esend_sigurg() by sending TCP packets with the URG flag to a service whose socket owner is configured as a process group. The fix explicitly identifies TCP URG packet reception as a potential remote denial-of-service vector.\nAC:L - The vulnerable condition is a lock-order deadlock, but an attacker can repeatedly send URG packets and, in a plausible forking/waiting network service, induce connection churn that exercises the other tasklist_lock paths. There is no memory-layout dependency or other hard-to-satisfy condition.\nPR:N - The network attacker does not need local privileges or authentication to send TCP URG traffic to an exposed service. The fcntl process-group ownership is target service state, not an attacker privilege requirement.\nUI:N - Exploitation does not require a user to open a file or perform an interactive action. Once the service is reachable and configured, packets alone can trigger the vulnerable path.\nS:U - The impact is within the Linux kernel and the same host security authority. It does not cross a VM, sandbox, or hardware isolation boundary.\nC:N - The bug is a lock ordering deadlock, not a memory disclosure or use-after-free. The fixed traversal is RCU-safe and does not imply an attacker read primitive.\nI:N - The vulnerability does not corrupt memory or provide a write/control-flow primitive. It only causes unsafe lock acquisition ordering during signal delivery.\nA:H - The deadlock can hang kernel execution in softirq/tasklist_lock paths and deny service to the affected system. A kernel deadlock is a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:23.794Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/54626335ea4174ab2d9a183b511d825f6765e47b"
        },
        {
          "url": "https://git.kernel.org/stable/c/897d6a7247739fb1528f98c575df4f2e5de7f994"
        },
        {
          "url": "https://git.kernel.org/stable/c/32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5fa9e32fb6718f70c986ee14dd5d01b4846f331"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bee417678f1135e35b25a37734db46aa94258d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/20a93e397abe850c49b6fa0e8cc827b5f634a8f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfcc8e8d8a495bb34cae9e620adfb75fb13a3954"
        },
        {
          "url": "https://git.kernel.org/stable/c/36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/00633c4683828acd5256fa8d5163f440d74bbe71"
        }
      ],
      "title": "fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52946",
    "datePublished": "2026-06-24T16:26:04.419Z",
    "dateReserved": "2026-06-09T07:44:35.371Z",
    "dateUpdated": "2026-09-08T08:49:46.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53325 (GCVE-0-2026-53325)

Vulnerability from cvelistv5 – Published: 2026-06-29 04:53 – Updated: 2026-08-17 04:50

Title

agp/amd64: Fix broken error propagation in agp_amd64_probe()

Summary

In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/ce800993af477fc24…
https://git.kernel.org/stable/c/1d7d45050e14083c1…
https://git.kernel.org/stable/c/3e844a63668d1c3d1…
https://git.kernel.org/stable/c/eb045714bc6a2bbb0…
https://git.kernel.org/stable/c/564b3b3f6565313eb…
https://git.kernel.org/stable/c/53483a9f4ee9eeb18…
https://git.kernel.org/stable/c/0aa9b27c454c53074…
https://git.kernel.org/stable/c/cefe535a60a2e00e0…
https://git.kernel.org/stable/c/b08472db93b1ccff8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < ce800993af477fc24187349c6a20d3073140b759 (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < 1d7d45050e14083c1de1460c93f4063c1f0bca7b (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < 3e844a63668d1c3d10a9d347d7ebf161b2f91c84 (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < eb045714bc6a2bbb0befb7a31b996a196e188869 (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < 564b3b3f6565313eb6fa5355ffd037d6fb27897f (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < 53483a9f4ee9eeb18aa866ec16cce79e136987e1 (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < 0aa9b27c454c53074cde592eaceb442d30341585 (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < cefe535a60a2e00e09f4b2689b0c8ffc6912459a (git) Affected: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 , < b08472db93b1ccff84a7adec5779d47f0e9d3a30 (git)
Linux	Linux	Affected: 2.6.18 Unaffected: 0 , < 2.6.18 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/agp/amd64-agp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce800993af477fc24187349c6a20d3073140b759",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "1d7d45050e14083c1de1460c93f4063c1f0bca7b",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "3e844a63668d1c3d10a9d347d7ebf161b2f91c84",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "eb045714bc6a2bbb0befb7a31b996a196e188869",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "564b3b3f6565313eb6fa5355ffd037d6fb27897f",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "53483a9f4ee9eeb18aa866ec16cce79e136987e1",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "0aa9b27c454c53074cde592eaceb442d30341585",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "cefe535a60a2e00e09f4b2689b0c8ffc6912459a",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            },
            {
              "lessThan": "b08472db93b1ccff84a7adec5779d47f0e9d3a30",
              "status": "affected",
              "version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/agp/amd64-agp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.37",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.14",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nagp/amd64: Fix broken error propagation in agp_amd64_probe()\n\nA NULL pointer dereference was observed in the AMD64 AGP driver when\nrunning in a virtualized environment (e.g. qemu/kvm) without a physical\nAMD northbridge. The crash occurs in amd64_fetch_size() when attempting\nto dereference the pointer returned by node_to_amd_nb(0).\n\nThe root cause of this crash is broken error propagation in\nagp_amd64_probe(): When no AMD northbridges are found, cache_nbs()\ncorrectly returns -ENODEV. However, the probe function erroneously\nchecks the return value against exactly -1, rather than \u003c 0.\n\nAs a result, the hardware absence error is masked, allowing the driver\nto improperly proceed with initialization. It eventually calls\nagp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware\ndoes not exist, node_to_amd_nb(0) returns NULL, leading to a General\nProtection Fault (GPF) when accessing its -\u003emisc member.\n\nFix the issue by correcting the error check in agp_amd64_probe() to\nabort properly when cache_nbs() returns any negative error code. This\nprevents the driver from erroneously proceeding without hardware, thereby\navoiding the subsequent NULL pointer dereference at its source."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:26.049Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce800993af477fc24187349c6a20d3073140b759"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7d45050e14083c1de1460c93f4063c1f0bca7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e844a63668d1c3d10a9d347d7ebf161b2f91c84"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb045714bc6a2bbb0befb7a31b996a196e188869"
        },
        {
          "url": "https://git.kernel.org/stable/c/564b3b3f6565313eb6fa5355ffd037d6fb27897f"
        },
        {
          "url": "https://git.kernel.org/stable/c/53483a9f4ee9eeb18aa866ec16cce79e136987e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa9b27c454c53074cde592eaceb442d30341585"
        },
        {
          "url": "https://git.kernel.org/stable/c/cefe535a60a2e00e09f4b2689b0c8ffc6912459a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b08472db93b1ccff84a7adec5779d47f0e9d3a30"
        }
      ],
      "title": "agp/amd64: Fix broken error propagation in agp_amd64_probe()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53325",
    "datePublished": "2026-06-29T04:53:35.833Z",
    "dateReserved": "2026-06-09T07:44:35.398Z",
    "dateUpdated": "2026-08-17T04:50:26.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53354 (GCVE-0-2026-53354)

Vulnerability from cvelistv5 – Published: 2026-07-01 13:32 – Updated: 2026-08-17 04:50

Title

arm64: errata: Mitigate TLBI errata on various Arm CPUs

Summary

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are translated by an affected TLB entry. These errata ONLY affect the completion of memory accesses which have been translated by an invalidated TLB entry, and these errata DO NOT affect the actual invalidation of TLB entries. TLB entries are removed correctly. This issue has been assigned CVE ID CVE-2025-10263. To mitigate this issue, Arm recommends that software follows any affected TLBI;DSB sequence with an additional TLBI;DSB, which will ensure that all memory write effects affected by the first TLBI have been globally observed. The additional TLBI can use any operation that is broadcast to affected CPUs, and the additional DSB can use any option that is sufficient to complete the additional TLBI. The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate the issue. Enable this workaround for affected CPUs, and update the silicon errata documentation accordingly. Note that due to the manner in which Arm develops IP and tracks errata, some CPUs share a common erratum number.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/92505820322940300…
https://git.kernel.org/stable/c/8364384ae82fbffdf…
https://git.kernel.org/stable/c/7c3ad9365079e716b…
https://git.kernel.org/stable/c/e717a4d08779f1a28…
https://git.kernel.org/stable/c/4e7c80742e6dada9f…
https://git.kernel.org/stable/c/d4fd4282204044fde…
https://git.kernel.org/stable/c/1b47b1e1d8675fdf5…
https://git.kernel.org/stable/c/1268c64e2bcb6e968…
https://git.kernel.org/stable/c/cfd391e74134db664…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < 925058203229403008d77a52b1e63e2ae5f4a3cf (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < 8364384ae82fbffdf8968abaac3455ed854da18d (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < 7c3ad9365079e716b57d2363d3081ee7680cc18e (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < e717a4d08779f1a28d6e0275e75040b12c33c753 (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < 4e7c80742e6dada9f8b9ad63f3a49c03af07ecb8 (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < d4fd4282204044fdedd1e42abbe70a9206f74ec0 (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < 1b47b1e1d8675fdf5f6e11e7fa19c704d8c6f5cd (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < 1268c64e2bcb6e968152990e87bd10c440fcc9c0 (git) Affected: 58d0ba578bc3b7c044d4ef570307bcb03862cb66 , < cfd391e74134db664feb499d43af286380b10ba8 (git)
Linux	Linux	Affected: 3.7 Unaffected: 0 , < 3.7 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1.1 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "Documentation/arch/arm64/silicon-errata.rst",
            "arch/arm64/Kconfig",
            "arch/arm64/kernel/cpu_errata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "925058203229403008d77a52b1e63e2ae5f4a3cf",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "8364384ae82fbffdf8968abaac3455ed854da18d",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "7c3ad9365079e716b57d2363d3081ee7680cc18e",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "e717a4d08779f1a28d6e0275e75040b12c33c753",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "4e7c80742e6dada9f8b9ad63f3a49c03af07ecb8",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "d4fd4282204044fdedd1e42abbe70a9206f74ec0",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "1b47b1e1d8675fdf5f6e11e7fa19c704d8c6f5cd",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "1268c64e2bcb6e968152990e87bd10c440fcc9c0",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            },
            {
              "lessThan": "cfd391e74134db664feb499d43af286380b10ba8",
              "status": "affected",
              "version": "58d0ba578bc3b7c044d4ef570307bcb03862cb66",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "Documentation/arch/arm64/silicon-errata.rst",
            "arch/arm64/Kconfig",
            "arch/arm64/kernel/cpu_errata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.1",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: errata: Mitigate TLBI errata on various Arm CPUs\n\nA number of CPUs developed by Arm suffer from errata whereby a broadcast\nTLBI;DSB sequence may complete before the global observation of writes\nwhich are translated by an affected TLB entry.\n\nThese errata ONLY affect the completion of memory accesses which have\nbeen translated by an invalidated TLB entry, and these errata DO NOT\naffect the actual invalidation of TLB entries. TLB entries are removed\ncorrectly.\n\nThis issue has been assigned CVE ID CVE-2025-10263.\n\nTo mitigate this issue, Arm recommends that software follows any\naffected TLBI;DSB sequence with an additional TLBI;DSB, which will\nensure that all memory write effects affected by the first TLBI have\nbeen globally observed. The additional TLBI can use any operation that\nis broadcast to affected CPUs, and the additional DSB can use any option\nthat is sufficient to complete the additional TLBI.\n\nThe ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate\nthe issue. Enable this workaround for affected CPUs, and update the\nsilicon errata documentation accordingly.\n\nNote that due to the manner in which Arm develops IP and tracks errata,\nsome CPUs share a common erratum number."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable TLBI completion path is reachable by locally executing code that drives memory permission/unmap activity through syscalls or guest/KVM memory-management activity. It is not directly exposed by network packets.\nAC:L - Although the erratum depends on timing, the attacker can repeatedly arrange concurrent stores and translation invalidations on affected multicore Arm systems. The triggering race is therefore attacker-influenced rather than dependent on a one-off external condition.\nPR:L - A basic unprivileged local user or guest workload can reach the relevant Stage-1/Stage-2 TLBI paths without host administrative privileges. No real root capability in the init namespace is required.\nUI:N - After the attacker has local code execution, exploitation only requires attacker-driven memory operations/syscalls or guest activity. No separate victim action is needed.\nS:C - In a severe reasonable deployment such as Arm KVM/cloud virtualization, bypassing Stage-2 or higher-level translation protections can let guest-controlled writes affect hypervisor/host resources. That crosses a security authority boundary.\nC:H - The primitive can enable privilege escalation to kernel or hypervisor context, making protected memory and secrets accessible. Even though the erratum affects stores, successful control of privileged context supports high confidentiality impact.\nI:H - The core issue permits writes to memory after translation permissions or ownership should have been revoked. This is a high-integrity memory corruption primitive with plausible kernel or hypervisor privilege escalation.\nA:H - Incorrect late writes into protected or reused memory can corrupt kernel/hypervisor state. Failed exploitation or corruption can plausibly cause kernel panic, guest/host crash, or system instability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:27.156Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/925058203229403008d77a52b1e63e2ae5f4a3cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/8364384ae82fbffdf8968abaac3455ed854da18d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c3ad9365079e716b57d2363d3081ee7680cc18e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e717a4d08779f1a28d6e0275e75040b12c33c753"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e7c80742e6dada9f8b9ad63f3a49c03af07ecb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4fd4282204044fdedd1e42abbe70a9206f74ec0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b47b1e1d8675fdf5f6e11e7fa19c704d8c6f5cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1268c64e2bcb6e968152990e87bd10c440fcc9c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd391e74134db664feb499d43af286380b10ba8"
        }
      ],
      "title": "arm64: errata: Mitigate TLBI errata on various Arm CPUs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53354",
    "datePublished": "2026-07-01T13:32:30.246Z",
    "dateReserved": "2026-06-09T07:44:35.400Z",
    "dateUpdated": "2026-08-17T04:50:27.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11175-1

CVE-2026-45866 (GCVE-0-2026-45866)

CVE-2026-52946 (GCVE-0-2026-52946)

CVE-2026-53325 (GCVE-0-2026-53325)

CVE-2026-53354 (GCVE-0-2026-53354)

Tags

Sightings

Nomenclature

Related by attack behaviour