{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-50087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:34.847637Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:13.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5aa558232edc30468d1f35108826dd5b3ffe978f",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "18048cba444a7c41dbf42c180d6b46606fc24c51",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "08272646cd7c310642c39b7f54348fddd7987643",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "0c29e149b6bb498778ed8a1c9597b51acfba7856",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "87c4896d5dd7fd9927c814cf3c6289f41de3b562",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "689640efc0a2c4e07e6f88affe6d42cd40cc3f85",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.256",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.211",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails\n\nWhen scpi probe fails, at any point, we need to ensure that the scpi_info\nis not set and will remain NULL until the probe succeeds. If it is not\ntaken care, then it could result use-after-free as the value is exported\nvia get_scpi_ops() and could refer to a memory allocated via devm_kzalloc()\nbut freed when the probe fails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the ARM SCPI platform firmware driver (mailbox/shared-memory to the on-SoC SCP), reached during local driver probe and consumer deferred probes (scpi-hwmon/clk/cpufreq/pm-domain), not via network or adjacent protocols.\nAC:L - Any probe failure after early assignment of global scpi_info (including common -EPROBE_DEFER when the mailbox is not ready, or SCP firmware/capability failure) deterministically leaves a dangling pointer that get_scpi_ops() consumers then use; the attacker does not need a hard-to-influence race.\nPR:L - The UAF is hit from in-kernel deferred probe of SCPI consumers without CAP_SYS_ADMIN/sysfs bind, so a normal local unprivileged user context on an affected ARM SCPI system is sufficient for the highest-severity exploitation model (heap spray against the freed scpi_drvinfo).\nUI:N - No victim action is required; probe failure and subsequent get_scpi_ops() use occur automatically during boot/deferred probing.\nS:U - Impact remains within the kernel\u2019s security authority (local privilege escalation/DoS via kernel UAF); it does not cross a VM, IOMMU, or other separate security boundary.\nC:H - This is a use-after-free of scpi_drvinfo exported through get_scpi_ops(); with heap reuse the attacker can control the returned scpi_ops and adjacent state, enabling arbitrary kernel reads.\nI:H - UAF of the ops/channel state enables forged function pointers and writes through SCPI ops (clocks, DVFS, power, sensors), so integrity impact includes control-flow hijacking and arbitrary modification.\nA:H - The reported crash is a kernel oops/NULL instruction abort in scpi_hwmon_probe via the dangling scpi_info, and UAFs generally cause panics even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:21.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5aa558232edc30468d1f35108826dd5b3ffe978f"
        },
        {
          "url": "https://git.kernel.org/stable/c/18048cba444a7c41dbf42c180d6b46606fc24c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/08272646cd7c310642c39b7f54348fddd7987643"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c29e149b6bb498778ed8a1c9597b51acfba7856"
        },
        {
          "url": "https://git.kernel.org/stable/c/87c4896d5dd7fd9927c814cf3c6289f41de3b562"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87"
        },
        {
          "url": "https://git.kernel.org/stable/c/689640efc0a2c4e07e6f88affe6d42cd40cc3f85"
        }
      ],
      "title": "firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50087",
    "datePublished": "2025-06-18T11:02:28.079Z",
    "dateReserved": "2025-06-18T10:57:27.410Z",
    "dateUpdated": "2026-08-05T08:57:21.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22026",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:43.644362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:04.589Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfsctl.c",
            "fs/nfsd/stats.c",
            "fs/nfsd/stats.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "51107e768de6821b68aa34a136d07bc7a09cf6c3",
              "status": "affected",
              "version": "5545496966631cd40ad3aa6450be56d0e5773d10",
              "versionType": "git"
            },
            {
              "lessThan": "e4316bd85e42b01125b2aab691769234a388b8a3",
              "status": "affected",
              "version": "73c43bccf25cec9cdec62fc22a513c28a4b28390",
              "versionType": "git"
            },
            {
              "lessThan": "51da899c209a9624e48be416bd30e7ed5cd6c3d8",
              "status": "affected",
              "version": "10ece754df9a799131a1cf3197e9d26c04ddec22",
              "versionType": "git"
            },
            {
              "lessThan": "30405b23b4d5e2a596fb756d48119d7293194e75",
              "status": "affected",
              "version": "6f8d6ed3426a17f77628cebfb6a6e2c6f2b2496c",
              "versionType": "git"
            },
            {
              "lessThan": "6a59b70fe71ec66c0dd19e2c279c71846a3fb2f0",
              "status": "affected",
              "version": "93483ac5fec62cc1de166051b219d953bb5e4ef4",
              "versionType": "git"
            },
            {
              "lessThan": "e31957a819e60cf0bc9a49408765e6095fd3d046",
              "status": "affected",
              "version": "93483ac5fec62cc1de166051b219d953bb5e4ef4",
              "versionType": "git"
            },
            {
              "lessThan": "9d9456185fd5f1891c74354ee297f19538141ead",
              "status": "affected",
              "version": "93483ac5fec62cc1de166051b219d953bb5e4ef4",
              "versionType": "git"
            },
            {
              "lessThan": "930b64ca0c511521f0abdd1d57ce52b2a6e3476b",
              "status": "affected",
              "version": "93483ac5fec62cc1de166051b219d953bb5e4ef4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b7b05f98f3f06fea3986b46e5c7fe2928676b02d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.259",
              "status": "affected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.210",
              "status": "affected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.164",
              "status": "affected",
              "version": "6.1.106",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.125",
              "status": "affected",
              "version": "6.6.47",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfsctl.c",
            "fs/nfsd/stats.c",
            "fs/nfsd/stats.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.10.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.15.166",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "6.1.106",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.125",
                  "versionStartIncluding": "6.6.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.24",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: don\u0027t ignore the return code of svc_proc_register()\n\nCurrently, nfsd_proc_stat_init() ignores the return value of\nsvc_proc_register(). If the procfile creation fails, then the kernel\nwill WARN when it tries to remove the entry later.\n\nFix nfsd_proc_stat_init() to return the same type of pointer as\nsvc_proc_register(), and fix up nfsd_net_init() to check that and fail\nthe nfsd_net construction if it occurs.\n\nsvc_proc_register() can fail if the dentry can\u0027t be allocated, or if an\nidentical dentry already exists. The second case is pretty unlikely in\nthe nfsd_net construction codepath, so if this happens, return -ENOMEM."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T11:57:15.085Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/51107e768de6821b68aa34a136d07bc7a09cf6c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4316bd85e42b01125b2aab691769234a388b8a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/51da899c209a9624e48be416bd30e7ed5cd6c3d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/30405b23b4d5e2a596fb756d48119d7293194e75"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a59b70fe71ec66c0dd19e2c279c71846a3fb2f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e31957a819e60cf0bc9a49408765e6095fd3d046"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d9456185fd5f1891c74354ee297f19538141ead"
        },
        {
          "url": "https://git.kernel.org/stable/c/930b64ca0c511521f0abdd1d57ce52b2a6e3476b"
        }
      ],
      "title": "nfsd: don\u0027t ignore the return code of svc_proc_register()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22026",
    "datePublished": "2025-04-16T14:11:47.243Z",
    "dateReserved": "2024-12-29T08:45:45.807Z",
    "dateUpdated": "2026-06-19T11:57:15.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:55:28.428Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-37797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:32.363946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:02.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "28b09a067831f7317c3841812276022d6c940677",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            },
            {
              "lessThan": "39b9095dd3b55d9b2743df038c32138efa34a9de",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            },
            {
              "lessThan": "fcc8ede663569c704fb00a702973bd6c00373283",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            },
            {
              "lessThan": "20d584a33e480ae80d105f43e0e7b56784da41b9",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            },
            {
              "lessThan": "3aa852e3605000d5c47035c3fc3a986d14ccfa9f",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            },
            {
              "lessThan": "86cd4641c713455a4f1c8e54c370c598c2b1cee0",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            },
            {
              "lessThan": "bb583c88d23b72d8d16453d24856c99bd93dadf5",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            },
            {
              "lessThan": "3df275ef0a6ae181e8428a6589ef5d5231e58b5c",
              "status": "affected",
              "version": "21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.293",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.136",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class handling\n\nThis patch fixes a Use-After-Free vulnerability in the HFSC qdisc class\nhandling. The issue occurs due to a time-of-check/time-of-use condition\nin hfsc_change_class() when working with certain child qdiscs like netem\nor codel.\n\nThe vulnerability works as follows:\n1. hfsc_change_class() checks if a class has packets (q.qlen != 0)\n2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g.,\n   codel, netem) might drop packets and empty the queue\n3. The code continues assuming the queue is still non-empty, adding\n   the class to vttree\n4. This breaks HFSC scheduler assumptions that only non-empty classes\n   are in vttree\n5. Later, when the class is destroyed, this can lead to a Use-After-Free\n\nThe fix adds a second queue length check after qdisc_peek_len() to verify\nthe queue wasn\u0027t emptied."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The entire attack sequence (create hfsc qdisc, attach a codel/netem child, `tc class change`, then `tc class del`) is driven through rtnetlink RTM_NEWTCLASS/RTM_DELTCLASS messages, which require local system access. Per kernel CNA guidance, tc/netlink qdisc bugs are Local.\nAC:L - This is a deterministic time-of-check/time-of-use flaw inside a single netlink operation, not a thread race \u2014 the attacker picks the child qdisc (codel/netem) and its parameters so the peek is guaranteed to drop the packet and empty the queue. No condition outside the attacker\u0027s control is involved, and a reliable reproducer existed.\nPR:L - The tc class paths only check `netlink_ns_capable(skb, net-\u003euser_ns, CAP_NET_ADMIN)`, which an unprivileged user satisfies inside a new user+net namespace (`unshare -Urn`), where they can create a dummy/veth device, build the hfsc hierarchy and generate the traffic. Per guidance, tc/qdisc reachable via user namespaces is Low, not High.\nUI:N - The attacker performs every step \u2014 qdisc/class configuration, packet generation, class change and class deletion \u2014 with no action by any other user. Subsequent dequeue on the attacker\u0027s own device triggers the freed-object access.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own memory and privilege domain; there is no crossing of a VM, IOMMU, or other security-authority boundary. Standard kernel-local privilege escalation is Unchanged.\nC:H - The freed `hfsc_class` remains linked in the parent\u0027s vt_tree/eltree, so `vttree_firstfit()`/`eltree_get_mindl()` read `cl_f`, `cl_vt`, `cl_parent` and `cl-\u003eqdisc` out of reclaimed slab memory, giving an attacker who sprays the slot a controlled read primitive and kernel memory disclosure.\nI:H - The dangling rb_node yields `rb_erase()`/`rb_insert_color()` pointer writes plus the direct `cl-\u003ecl_parent-\u003ecl_cvtmin = cl-\u003ecl_vt` write through freed memory, and `qdisc_dequeue_peeked()` makes an indirect call through `cl-\u003eqdisc-\u003eops-\u003edequeue` read from the freed object \u2014 a full write/control-flow-hijack primitive for privilege escalation.\nA:H - Even without successful exploitation, traversing and erasing rb-tree nodes inside a kfree()d `hfsc_class` reliably corrupts the scheduler tree and panics or oopses the kernel, and the attacker can repeat it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:36.042Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/28b09a067831f7317c3841812276022d6c940677"
        },
        {
          "url": "https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c32138efa34a9de"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcc8ede663569c704fb00a702973bd6c00373283"
        },
        {
          "url": "https://git.kernel.org/stable/c/20d584a33e480ae80d105f43e0e7b56784da41b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3aa852e3605000d5c47035c3fc3a986d14ccfa9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/86cd4641c713455a4f1c8e54c370c598c2b1cee0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb583c88d23b72d8d16453d24856c99bd93dadf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3df275ef0a6ae181e8428a6589ef5d5231e58b5c"
        }
      ],
      "title": "net_sched: hfsc: Fix a UAF vulnerability in class handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37797",
    "datePublished": "2025-05-02T14:16:01.905Z",
    "dateReserved": "2025-04-16T04:51:23.941Z",
    "dateUpdated": "2026-08-05T11:57:36.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:55:56.301Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68f256305ceb426d545a0dc31f83c2ab1d211a1e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2f46d14919c39528c6e540ebc43f90055993eedc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "da7936518996d290e2fcfcaf6cd7e15bfd87804a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "11bccb054c1462fb069219f8e98e97a5a730758e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "76c4c22c2437d3d3880efc0f62eca06ef078d290",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c6f035044104c6ff656f4565cd22938dc892528c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c6936266f8bf98a53f28ef9a820e6a501e946d09",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6ccbda44e2cc3d26fd22af54c650d6d5d801addf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.293",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.136",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too\n\nSimilarly to the previous patch, we need to safe guard hfsc_dequeue()\ntoo. But for this one, we don\u0027t have a reliable reproducer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires configuring an HFSC qdisc hierarchy with a netem/codel child and deleting a class via rtnetlink (RTM_NEWQDISC/RTM_NEWTCLASS/RTM_DELTCLASS), which is a local netlink socket operation. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The attacker deterministically controls every element: the HFSC class curves (HFSC_RSC), the child qdisc\u0027s drop-on-dequeue behavior (netem loss/corrupt/nested-child enqueue failure, or aggressive codel parameters), packet injection, and the moment of class deletion; the whole sequence runs serialized under the qdisc/tree lock with no race to win. The absence of a maintainer reproducer reflects effort not spent, not a condition outside attacker control \u2014 the identical primitive in the companion commit 3df275ef0a6a had a reliable reproducer.\nPR:L - The rtnetlink handlers gate on netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against the caller\u0027s netns user_ns, so an unprivileged user obtains it simply with `unshare -Urn` and can then create a dummy/veth device plus the full hfsc+netem hierarchy. No real root in the init namespace is needed.\nUI:N - The attacker performs the entire sequence \u2014 qdisc/class setup, packet transmission, and class deletion \u2014 from their own process. No victim action is involved.\nS:U - The corruption stays within the kernel\u0027s own memory and privilege domain, yielding standard local privilege escalation rather than crossing into another security authority such as a hypervisor or IOMMU boundary.\nC:H - The freed struct hfsc_class remains linked in the scheduler\u0027s eligible rbtree and is subsequently dereferenced, so a heap spray of the kmalloc-1k slot lets the attacker read back kernel data through the reclaimed object and its cl-\u003eqdisc pointer chain, giving effectively arbitrary kernel memory disclosure.\nI:H - After the free, hfsc_dequeue() performs an indirect call via qdisc_dequeue_peeked() through sch-\u003edequeue read from the reclaimed object, plus bstats_update() writes and rb_erase()/rb_insert_color() on attacker-controlled node pointers \u2014 a direct control-flow hijack and arbitrary-write primitive leading to full kernel compromise.\nA:H - Even without successful heap grooming, traversing and erasing a freed rbtree node and calling through a stale function pointer reliably produces a kernel oops/panic, and the attacker can trigger it repeatedly for a complete denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:46.765Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68f256305ceb426d545a0dc31f83c2ab1d211a1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f46d14919c39528c6e540ebc43f90055993eedc"
        },
        {
          "url": "https://git.kernel.org/stable/c/da7936518996d290e2fcfcaf6cd7e15bfd87804a"
        },
        {
          "url": "https://git.kernel.org/stable/c/11bccb054c1462fb069219f8e98e97a5a730758e"
        },
        {
          "url": "https://git.kernel.org/stable/c/76c4c22c2437d3d3880efc0f62eca06ef078d290"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6f035044104c6ff656f4565cd22938dc892528c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6936266f8bf98a53f28ef9a820e6a501e946d09"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ccbda44e2cc3d26fd22af54c650d6d5d801addf"
        }
      ],
      "title": "net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37823",
    "datePublished": "2025-05-08T06:26:16.839Z",
    "dateReserved": "2025-04-16T04:51:23.947Z",
    "dateUpdated": "2026-08-05T11:57:46.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:48.713Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:36.204042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:03.458Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0194e391bb493aa6cec56d177b14df6b29188d5",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "03d0cc6889e02420125510b5444b570f4bbf53d5",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "cd0e92bb2b7542fb96397ffac639b4f5b099d0cb",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "4506bcaabe004d07be8ff09116a3024fbd6aa965",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "ea094f38d387d1b0ded5dee4a3e5720aa4ce0139",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "7d757f17bc2ef2727994ffa6d5d6e4bc4789a770",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "fc66772607101bd2030a4332b3bd0ea3b3605250",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "1bd5214ea681584c5886fea3ba03e49f93a43c0e",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            },
            {
              "lessThan": "fd60d8a086191fe33c2d719732d2482052fa6805",
              "status": "affected",
              "version": "90017accff61ae89283ad9a51f9ac46ca01633fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: linearize cloned gso packets in sctp_rcv\n\nA cloned head skb still shares these frag skbs in fraglist with the\noriginal head skb. It\u0027s not safe to access these frag skbs.\n\nsyzbot reported two use-of-uninitialized-memory bugs caused by this:\n\n  BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n   sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211\n   sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998\n   sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88\n   sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331\n   sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122\n   __release_sock+0x1da/0x330 net/core/sock.c:3106\n   release_sock+0x6b/0x250 net/core/sock.c:3660\n   sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360\n   sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885\n   sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031\n   inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851\n   sock_sendmsg_nosec net/socket.c:718 [inline]\n\nand\n\n  BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n   sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987\n   sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88\n   sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331\n   sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148\n   __release_sock+0x1d3/0x330 net/core/sock.c:3213\n   release_sock+0x6b/0x270 net/core/sock.c:3767\n   sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367\n   sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886\n   sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032\n   inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851\n   sock_sendmsg_nosec net/socket.c:712 [inline]\n\nThis patch fixes it by linearizing cloned gso packets in sctp_rcv()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable branch requires `skb_is_gso_sctp()`, and `SKB_GSO_SCTP` is set only by the local transmit path (`sk-\u003esk_gso_type` in net/sctp/socket.c:5042, applied in `sctp_packet_pack()`); net/sctp/offload.c registers no GRO handler and virtio/tun cannot carry an SCTP GSO type, so packets arriving from a real network are never `is_gso` and the attacker must originate the packet locally via `sendmsg()` on an SCTP socket looped back over `lo`/`veth`.\nAC:L - The attacker supplies every precondition: an SCTP socket sending more than PMTU to 127.0.0.1 to force the GSO cover-letter skb, and an AF_PACKET or raw socket to guarantee the clone via `dev_queue_xmit_nit()`, all repeatable in a loop; syzbot reproduced it independently twice.\nPR:L - No `capable()` check exists anywhere on the `sendmsg` \u2192 `sctp_packet_pack` \u2192 `sctp_rcv` \u2192 `sctp_inq_pop` path, the SCTP module autoloads on an unprivileged `socket(AF_INET, SOCK_SEQPACKET, IPPROTO_SCTP)`, and the CAP_NET_RAW needed for the cloning tap is obtainable by any local user with `unshare -Urn`.\nUI:N - The attacker performs the send, the clone setup, and the receive entirely from its own processes; no victim action or cooperation is involved.\nS:U - The out-of-bounds accesses and skb metadata corruption occur in kernel heap memory within the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - `sctp_inq_pop()` reads chunk headers past the frag skb\u0027s valid data (KMSAN uninit-value at inqueue.c:211), and the resulting attacker-influenced `chunk_end`/`datalen` drives `skb_trim()` in `sctp_ulpevent_make_rcvmsg()` on the clone queued for `recvmsg()`, while the co-owner of the shared frags (AF_PACKET/raw socket) reads them at pointers SCTP already advanced \u2014 both paths copy adjacent kernel heap out to userspace.\nI:H - SCTP mutates `data`, `len`, and `cb` of frag skbs concurrently owned by another subsystem, and `skb_pull(chunk-\u003eskb, sizeof(*ch))` on an already-consumed frag underflows `skb-\u003elen` to ~4 GB unchecked, leaving a corrupted length on a live skb while the full SCTP state machine executes on out-of-bounds bytes.\nA:H - The condition is a KASAN/KMSAN-reportable memory-safety violation whose ~4 GB `skb-\u003elen` underflow and out-of-range `skb_trim()` produce oops/panic in downstream copy and accounting paths, and any unprivileged local user can retrigger it in a loop."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:15.979Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0194e391bb493aa6cec56d177b14df6b29188d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/03d0cc6889e02420125510b5444b570f4bbf53d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd0e92bb2b7542fb96397ffac639b4f5b099d0cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/4506bcaabe004d07be8ff09116a3024fbd6aa965"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea094f38d387d1b0ded5dee4a3e5720aa4ce0139"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d757f17bc2ef2727994ffa6d5d6e4bc4789a770"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc66772607101bd2030a4332b3bd0ea3b3605250"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bd5214ea681584c5886fea3ba03e49f93a43c0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd60d8a086191fe33c2d719732d2482052fa6805"
        }
      ],
      "title": "sctp: linearize cloned gso packets in sctp_rcv",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38718",
    "datePublished": "2025-09-04T15:33:12.448Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:15.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}