{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.26.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.82.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.17.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-22T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Controller Area Network (CAN) ISO-TP (isotp) module. This vulnerability, known as a use-after-free, occurs when the system attempts to free a memory region while it is still being used. A local attacker could trigger this condition by sending a signal that interrupts a specific waiting process during a close operation. This can lead to memory corruption, potentially causing the system to crash (denial of service) or behave unpredictably."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-364",
                "description": "Signal Handler Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:09:14.681Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31474"
          },
          {
            "name": "RHBZ#2460646",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460646"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31474.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27731"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27288"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27789"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-22T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-22T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()",
        "workarounds": [
          {
            "lang": "en",
            "value": "Systems which do not require it can blocklist the `can_isotp` module to prevent it from being loaded. See https://access.redhat.com/solutions/41278 for more information."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb3d6efa78460e6d50bf68806d0db66265709f64",
              "status": "affected",
              "version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
              "versionType": "git"
            },
            {
              "lessThan": "9649d051e54413049c009638ec1dc23962c884a4",
              "status": "affected",
              "version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
              "versionType": "git"
            },
            {
              "lessThan": "eec8a1b18a79600bd4419079dc0026c1db72a830",
              "status": "affected",
              "version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
              "versionType": "git"
            },
            {
              "lessThan": "2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c",
              "status": "affected",
              "version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
              "versionType": "git"
            },
            {
              "lessThan": "424e95d62110cdbc8fd12b40918f37e408e35a92",
              "status": "affected",
              "version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix tx.buf use-after-free in isotp_sendmsg()\n\nisotp_sendmsg() uses only cmpxchg() on so-\u003etx.state to serialize access\nto so-\u003etx.buf. isotp_release() waits for ISOTP_IDLE via\nwait_event_interruptible() and then calls kfree(so-\u003etx.buf).\n\nIf a signal interrupts the wait_event_interruptible() inside close()\nwhile tx.state is ISOTP_SENDING, the loop exits early and release\nproceeds to force ISOTP_SHUTDOWN and continues to kfree(so-\u003etx.buf)\nwhile sendmsg may still be reading so-\u003etx.buf for the final CAN frame\nin isotp_fill_dataframe().\n\nThe so-\u003etx.buf can be allocated once when the standard tx.buf length needs\nto be extended. Move the kfree() of this potentially extended tx.buf to\nsk_destruct time when either isotp_sendmsg() and isotp_release() are done."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable ISO-TP transmit path is reached through local socket syscalls such as socket/bind/sendmsg/close on an AF_CAN CAN_ISOTP socket. A CAN peer may influence flow control, but the bug requires a local process to create the socket, send the PDU, and interrupt close.\nAC:L - Once ISO-TP extended PDU buffers are available, the attacker controls the socket options, message size, close operation, and signal timing needed to hit the close-vs-transmit race. The race is between attacker-controlled local operations and in-kernel asynchronous transmit completion, so no uncontrollable external condition is required.\nPR:L - The AF_CAN CAN_ISOTP socket create, bind, setsockopt, sendmsg, and release paths do not impose a CAP_NET_ADMIN check. An unprivileged local user can reach the vulnerable code on a system with an available CAN interface or equivalent namespace/preconfigured CAN setup.\nUI:N - No victim action is needed once the attacker can run local code. The attacker can drive the send, close, and signal sequence directly.\nS:U - The issue is a kernel memory lifetime bug in the same operating-system security authority. It does not cross a VM, IOMMU, or separate sandbox boundary by itself.\nC:H - The freed tx.buf can be reused while the ISO-TP transmit path later reads from it into outgoing CAN frames, creating a kernel heap use-after-free information disclosure primitive. Under conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - This is kernel heap use-after-free memory corruption reachable by attacker-controlled timing and heap grooming. Following the required conservative UAF guidance, it is treated as potentially exploitable for high integrity impact.\nA:H - The stale freed buffer can be dereferenced asynchronously during frame construction after release, which can trigger kernel memory corruption symptoms including oops or panic. Repeated local triggering can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:52.871Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64"
        },
        {
          "url": "https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c"
        },
        {
          "url": "https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92"
        }
      ],
      "title": "can: isotp: fix tx.buf use-after-free in isotp_sendmsg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31474",
    "datePublished": "2026-04-22T13:54:03.100Z",
    "dateReserved": "2026-03-09T15:48:24.098Z",
    "dateUpdated": "2026-08-05T12:22:52.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.26.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s rxrpc subsystem. An unprivileged local user could exploit an integer overflow vulnerability in the `rxrpc_preparse_xdr_yfs_rxgk()` function. This flaw occurs when processing specially crafted key and ticket lengths, causing an incorrect memory allocation size. Consequently, a heap buffer overflow can occur, potentially leading to arbitrary code execution or a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T12:31:55.191Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31641"
          },
          {
            "name": "RHBZ#2461548",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461548"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27288"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55618"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55618: Red Hat Enterprise Linux BaseOS (v. 10)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: rxrpc: Fix RxGK token loading to check bounds",
        "workarounds": [
          {
            "lang": "en",
            "value": "The rxrpc kernel module can be prevented from loading to mitigate this issue. This action may impact applications that rely on the rxrpc protocol.\nTo blacklist the rxrpc module:\n1. Create a file `/etc/modprobe.d/blacklist-rxrpc.conf` with the following content:\n   ```\n   blacklist rxrpc\n   install rxrpc /bin/true\n   ```\n2. Regenerate the initramfs:\n   ```bash\n   dracut -f -v\n   ```\n3. Reboot the system for the changes to take effect."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e04596cba8a86cbff9c3f4bf0a524a3a488773c",
              "status": "affected",
              "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6",
              "versionType": "git"
            },
            {
              "lessThan": "49875b360c2b83a3c226e189c502e501d83e6445",
              "status": "affected",
              "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6",
              "versionType": "git"
            },
            {
              "lessThan": "d179a868dd755b0cfcf7582e00943d702b9943b8",
              "status": "affected",
              "version": "0ca100ff4df64f5d0f6c1dd5080c3e096786bea6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each through round_up(x, 4)\nbefore using the rounded value for validation and allocation.  When the raw\nlength is \u003e= 0xfffffffd, round_up() wraps to 0, so the bounds check and\nkzalloc both use 0 while the subsequent memcpy still copies the original\n~4 GiB value, producing a heap buffer overflow reachable from an\nunprivileged add_key() call.\n\nFix this by:\n\n (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket\n     lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with\n     the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.\n\n (2) Sizing the flexible-array allocation from the validated raw key\n     length via struct_size_t() instead of the rounded value.\n\n (3) Caching the raw lengths so that the later field assignments and\n     memcpy calls do not re-read from the token, eliminating a class of\n     TOCTOU re-parse.\n\nThe control path (valid token with lengths within bounds) is unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable RxGK token parser is reachable through the local `add_key(\"rxrpc\", ...)` syscall with an attacker-supplied XDR payload. The network RxGK response path builds bounded lengths from packet data and does not allow the near-4GiB raw length values needed for this overflow.\nAC:L - An attacker can deterministically craft a small XDR token whose raw key or ticket length is \u003e= 0xfffffffd so `round_up()` wraps before validation/allocation. No race or victim-controlled timing is required.\nPR:L - The fix commit explicitly describes the bug as reachable from an unprivileged `add_key()` call. The only practical gate is write access to a user-writable keyring, which a normal local user can have without real root capabilities.\nUI:N - Exploitation only requires the attacker to invoke the syscall with a crafted payload. No separate victim action is needed.\nS:U - The vulnerable code runs in the kernel and impacts kernel memory within the same security authority. This is a standard local kernel compromise/DoS scenario rather than a defined cross-scope boundary escape.\nC:H - The bug is a heap memory corruption caused by copying a near-4GiB attacker-selected length from a small token into an undersized `rxgk_key` allocation. Such kernel memory corruption is defensibly scored as enabling high confidentiality impact.\nI:H - The vulnerable `memcpy()` writes far beyond the allocated heap object, giving a heap buffer overflow primitive. Under the required higher-severity rule, this is scored as potentially enabling arbitrary kernel memory modification or code execution.\nA:H - The malformed token can reliably trigger massive out-of-bounds kernel memory access/corruption. At minimum this can cause a kernel oops or panic, producing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:05.369Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773c"
        },
        {
          "url": "https://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445"
        },
        {
          "url": "https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8"
        }
      ],
      "title": "rxrpc: Fix RxGK token loading to check bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31641",
    "datePublished": "2026-04-24T14:44:56.204Z",
    "dateReserved": "2026-03-09T15:48:24.126Z",
    "dateUpdated": "2026-08-20T12:31:55.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:47:59.039Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "fb1f54b7d16f393b8b65d328410f78b4beea8fcc",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "3fd6547f5b8ac99687be6d937a0321efda760597",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "eb9c6aeb512f877cf397deb1e4526f646c70e4a7",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "15fa9ead4d5e6b6b9c794e84144146c917f2cb62",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "b313e9037d98c13938740e5ebda7852929366dff",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "9b55b253907e7431210483519c5ad711a37dafa1",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix slab-use-after-free in __inet_lookup_established\n\nThe ehash table lookups are lockless and rely on\nSLAB_TYPESAFE_BY_RCU to guarantee socket memory stability\nduring RCU read-side critical sections. Both tcp_prot and\ntcpv6_prot have their slab caches created with this flag\nvia proto_register().\n\nHowever, MPTCP\u0027s mptcp_subflow_init() copies tcpv6_prot into\ntcpv6_prot_override during inet_init() (fs_initcall, level 5),\nbefore inet6_init() (module_init/device_initcall, level 6) has\ncalled proto_register(\u0026tcpv6_prot). At that point,\ntcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab\nremains NULL permanently.\n\nThis causes MPTCP v6 subflow child sockets to be allocated via\nkmalloc (falling into kmalloc-4k) instead of the TCPv6 slab\ncache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so\nwhen these sockets are freed without SOCK_RCU_FREE (which is\ncleared for child sockets by design), the memory can be\nimmediately reused. Concurrent ehash lookups under\nrcu_read_lock can then access freed memory, triggering a\nslab-use-after-free in __inet_lookup_established.\n\nFix this by splitting the IPv6-specific initialization out of\nmptcp_subflow_init() into a new mptcp_subflow_v6_init(), called\nfrom mptcp_proto_v6_init() before protocol registration. This\nensures tcpv6_prot_override.slab correctly inherits the\nSLAB_TYPESAFE_BY_RCU slab cache."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote IPv6 TCP/MPTCP packets reach `tcp_v6_rcv()` and its lockless established-socket ehash lookup through the normal network receive path. A reachable IPv6 MPTCP service can be exercised over the network without local execution.\nAC:L - The vulnerability is a race between freeing an MPTCP IPv6 child socket and concurrent ehash lookup, but the attacker can drive both sides by repeatedly creating/closing MPTCP connections or subflows while sending packets. Under the required rule, this attacker-controlled race is Low complexity.\nPR:N - No local account, capability, namespace setup, or protocol authentication is needed to send the packets that reach the vulnerable receive path. The only environmental requirement is a reachable MPTCP IPv6 listener.\nUI:N - No victim user action is required after the vulnerable service is listening. Network traffic alone can trigger allocation, teardown, and lookup of the affected sockets.\nS:U - The flaw is in the kernel networking stack and impacts kernel-managed resources within the same security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - This is a kernel heap use-after-free where freed socket memory can be immediately reused while lockless lookup still dereferences it. Such UAF conditions are defensibly capable of exposing kernel memory or primitives useful for broader disclosure.\nI:H - The stale socket pointer can reference attacker-influenced reused kmalloc memory during refcounting and socket processing. Kernel heap UAF is treated as high integrity impact because it can plausibly be developed into write/control-flow corruption.\nA:H - The reported condition is a slab-use-after-free in `__inet_lookup_established`, which can crash or oops the kernel. A remote attacker can trigger it repeatedly against a reachable affected service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:19.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb1f54b7d16f393b8b65d328410f78b4beea8fcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd6547f5b8ac99687be6d937a0321efda760597"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb9c6aeb512f877cf397deb1e4526f646c70e4a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/15fa9ead4d5e6b6b9c794e84144146c917f2cb62"
        },
        {
          "url": "https://git.kernel.org/stable/c/b313e9037d98c13938740e5ebda7852929366dff"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b55b253907e7431210483519c5ad711a37dafa1"
        }
      ],
      "title": "mptcp: fix slab-use-after-free in __inet_lookup_established",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31669",
    "datePublished": "2026-04-24T14:45:17.295Z",
    "dateReserved": "2026-03-09T15:48:24.130Z",
    "dateUpdated": "2026-09-08T08:47:59.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f5d446624345d309e7a4a1b27ea9f028d6a8c5d9",
              "status": "affected",
              "version": "91d19383b7ed035e22165ae5c836e50bb9f95fbe",
              "versionType": "git"
            },
            {
              "lessThan": "aba0aea354015794e8312dd7efe726967e58aefe",
              "status": "affected",
              "version": "42ecf1947135110ea08abeaca39741636f9a2285",
              "versionType": "git"
            },
            {
              "lessThan": "eaf32002ca7b1ba51c9f140991fd9febe6de79f0",
              "status": "affected",
              "version": "42ecf1947135110ea08abeaca39741636f9a2285",
              "versionType": "git"
            },
            {
              "lessThan": "bc39a094730ce062fa034a529c93147c096cb488",
              "status": "affected",
              "version": "42ecf1947135110ea08abeaca39741636f9a2285",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.81",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync\n\nhci_le_big_create_sync() uses DEFINE_FLEX to allocate a\nstruct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)\nBIS entries.  However, conn-\u003enum_bis can hold up to HCI_MAX_ISO_BIS (31)\nentries \u2014 validated against ISO_MAX_NUM_BIS (0x1f) in the caller\nhci_conn_big_create_sync().  When conn-\u003enum_bis is between 18 and 31,\nthe memcpy that copies conn-\u003ebis into cp-\u003ebis writes up to 14 bytes\npast the stack buffer, corrupting adjacent stack memory.\n\nThis is trivially reproducible: binding an ISO socket with\nbc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will\neventually trigger hci_le_big_create_sync() from the HCI command\nsync worker, causing a KASAN-detectable stack-out-of-bounds write:\n\n  BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0\n  Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71\n\nFix this by changing the DEFINE_FLEX count from the incorrect 0x11 to\nHCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that\nconn-\u003ebis can actually carry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached through locally created AF_BLUETOOTH ISO sockets via bind/listen or deferred receive; the Bluetooth BIG Info event only completes a userspace-initiated ISO sync path.\nAC:L - An attacker can choose a valid bc_num_bis value from 18 to 31 and valid BIS indexes, with no race or hard-to-control memory condition required.\nPR:L - Creating, binding, and listening on BTPROTO_ISO sockets does not require CAP_NET_ADMIN or other elevated capabilities, but it does require local code execution as an unprivileged user.\nUI:N - The attacker can trigger the vulnerable socket operations and resulting HCI sync worker path without any victim action.\nS:U - The corruption occurs within the kernel and affects the same operating-system security authority; ordinary kernel privilege escalation remains scope unchanged.\nC:H - This is kernel stack memory corruption from an out-of-bounds write, which can plausibly be leveraged to disclose sensitive kernel memory when exploited.\nI:H - The bug is a controlled out-of-bounds write past a stack buffer in kernel context, making high-integrity impact defensible.\nA:H - The issue is KASAN-reproducible as a stack out-of-bounds write in a kernel worker and can crash or destabilize the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:04.625Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f5d446624345d309e7a4a1b27ea9f028d6a8c5d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba0aea354015794e8312dd7efe726967e58aefe"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaf32002ca7b1ba51c9f140991fd9febe6de79f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc39a094730ce062fa034a529c93147c096cb488"
        }
      ],
      "title": "Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31772",
    "datePublished": "2026-05-01T14:15:00.582Z",
    "dateReserved": "2026-03-09T15:48:24.140Z",
    "dateUpdated": "2026-08-05T12:25:04.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-30T10:39:32.708Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/28/12"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-485.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/sys-hypervisor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3af585e1728c917682b6a3de9a69b41fb9194d4",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            },
            {
              "lessThan": "8288d031a01dbacfde3fc643f7be3d23504de64d",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            },
            {
              "lessThan": "f458ba102da97fafca106327086fc95f3fc764cb",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            },
            {
              "lessThan": "4b4defd2fce3f966c25adabf46644a85558f1169",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            },
            {
              "lessThan": "5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            },
            {
              "lessThan": "d5f59216650c51e5e3fcb7517c825bc8047f60ef",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            },
            {
              "lessThan": "52cecff98bda2c51eed1c6ce9d21c5d6268fb19d",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            },
            {
              "lessThan": "27fdbab4221b375de54bf91919798d88520c6e28",
              "status": "affected",
              "version": "84b7625728ea311ea35bdaa0eded53c1c56baeaa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/sys-hypervisor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.204",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.170",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.254",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.204",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.170",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.137",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.85",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.26",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBuffer overflow in drivers/xen/sys-hypervisor.c\n\nThe build id returned by HYPERVISOR_xen_version(XENVER_build_id) is\nneither NUL terminated nor a string.\n\nThe first causes a buffer overflow as sprintf in buildid_show will\nread and copy till it finds a NUL.\n\n00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|\n00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|\n00000017\n\nSo use a memcpy instead of sprintf to have the correct value:\n\n00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|\n00000010  b9 a8 01 42                                       |...B|\n00000014\n\n(the above have a hack to embed a zero inside and check it\u0027s\nreturned correctly).\n\nThis is XSA-485 / CVE-2026-31786"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable buildid_show path is reached by a local read of /sys/hypervisor/properties/buildid inside a Linux Xen domain. It is not reachable directly from network packets or adjacent/physical interfaces.\nAC:L - Triggering the bug only requires reading a sysfs file, with no race or special timing. Any uncertainty about heap layout affects exploitation details, so the higher-severity low complexity is appropriate.\nPR:L - The sysfs attribute is read-only mode 0444, so any unprivileged local user in the Xen guest can access it. No capability, authentication, or real-root check gates the read path.\nUI:N - No victim action is required beyond the attacker performing the sysfs read. The vulnerable code runs synchronously in the attacker\u0027s read path.\nS:U - The impact is within the Linux Xen guest kernel security authority. This is not a Xen guest-to-host escape or cross-VM boundary violation.\nC:H - The bug performs an out-of-bounds read past the hypervisor build ID and can return adjacent kernel memory through a user-readable sysfs file. The Xen advisory states kernel secrets may be leaked.\nI:H - If no NUL byte is encountered before the PAGE_SIZE sysfs buffer is exceeded, sprintf can write past the sysfs buffer and corrupt kernel memory. The advisory identifies privilege escalation as possible, so high integrity impact is defensible.\nA:H - The out-of-bounds read/write can corrupt kernel memory and crash the guest kernel. The advisory explicitly lists DoS as a possible impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:11.040Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8288d031a01dbacfde3fc643f7be3d23504de64d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f458ba102da97fafca106327086fc95f3fc764cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b4defd2fce3f966c25adabf46644a85558f1169"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5f59216650c51e5e3fcb7517c825bc8047f60ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/52cecff98bda2c51eed1c6ce9d21c5d6268fb19d"
        },
        {
          "url": "https://git.kernel.org/stable/c/27fdbab4221b375de54bf91919798d88520c6e28"
        }
      ],
      "title": "Buffer overflow in drivers/xen/sys-hypervisor.c",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31786",
    "datePublished": "2026-04-30T10:31:28.293Z",
    "dateReserved": "2026-03-09T15:48:24.141Z",
    "dateUpdated": "2026-08-05T12:25:11.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-30T10:39:37.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/28/14"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-487.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/privcmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbf862ce9f009128ab86b234d91413a3e450beb4",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            },
            {
              "lessThan": "2b985d3a024b9e8c24e21671b34e855569763808",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            },
            {
              "lessThan": "1576ff3869cbd3620717195f971c85b7d7fd62b5",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            },
            {
              "lessThan": "402d84ad9e89bd4cbfd07ca8598532b7021daf95",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            },
            {
              "lessThan": "2894a351fe2ea8684919d36df3188b9a35e3926f",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            },
            {
              "lessThan": "446ee446d9ae66f36e95c3c90bbcc4e56b94cde0",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            },
            {
              "lessThan": "71bf829800758a6e3889096e4754ef47ba7fc850",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            },
            {
              "lessThan": "24daca4fc07f3ff8cd0e3f629cd982187f48436a",
              "status": "affected",
              "version": "d71f513985c22f1050295d1a7e4327cf9fb060da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/privcmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.204",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.170",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.254",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.204",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.170",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.137",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.85",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.26",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.3",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n    - xen_unmap_domain_gfn_range()\n    - xen_free_unpopulated_pages()\n    - kvfree(pages)\n\nThe surviving VMA still holds the dangling pointer. When it is later\ndestroyed, the same sequence runs again, which leads to a double free.\n\nFix this issue by adding a .may_split callback denying the VMA split.\n\nThis is XSA-487 / CVE-2026-31787"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:44:41.402Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808"
        },
        {
          "url": "https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95"
        },
        {
          "url": "https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f"
        },
        {
          "url": "https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0"
        },
        {
          "url": "https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850"
        },
        {
          "url": "https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a"
        }
      ],
      "title": "xen/privcmd: fix double free via VMA splitting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31787",
    "datePublished": "2026-04-30T10:31:28.992Z",
    "dateReserved": "2026-03-09T15:48:24.141Z",
    "dateUpdated": "2026-06-14T17:44:41.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d88541ffd56d62a61e77209080001eddd4d69815",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            },
            {
              "lessThan": "43f5b19fd190fea20d052bc84741b28031d5baa9",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            },
            {
              "lessThan": "5f4061f8225d18695e5afe9bbf1cb7bd673d7872",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            },
            {
              "lessThan": "e5a75bf026c686b91a7dc6f9c5caf5016745d1fe",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            },
            {
              "lessThan": "c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70f",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: fix use-after-free in add_adev() error path\n\nIf auxiliary_device_add() fails, add_adev() jumps to add_fail and calls\nauxiliary_device_uninit(adev).\n\nThe auxiliary device has its release callback set to adev_release(),\nwhich frees the containing struct mana_adev. Since adev is embedded in\nstruct mana_adev, the subsequent fall-through to init_fail and access\nto adev-\u003eid may result in a use-after-free.\n\nFix this by saving the allocated auxiliary device id in a local\nvariable before calling auxiliary_device_add(), and use that saved id\nin the cleanup path after auxiliary_device_uninit()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `add_adev()` error path is reached during MANA PCI driver probe/resume/recovery or auxiliary RDMA service handling, not by processing received network packets. The highest defensible attacker path is local influence over driver/device lifecycle or resource-failure conditions.\nAC:L - Once `auxiliary_device_add()` fails, the UAF is deterministic because `auxiliary_device_uninit()` releases the embedded object and the cleanup path immediately reads `adev-\u003eid`. No attacker-uncontrolled race is required beyond reaching that failure path.\nPR:L - The path is not exposed to unauthenticated remote peers, but a local attacker can plausibly influence resource exhaustion/failure conditions around driver lifecycle events. Direct sysfs/module lifecycle control is privileged, but Low is the higher-severity defensible choice under the conservative scoring rule.\nUI:N - No separate victim action is required once the attacker can exercise or influence the local driver lifecycle/failure path. Probe, resume, and service-event handling run in kernel context.\nS:U - The affected component and impacts are within the Linux kernel security scope. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel use-after-free of an auxiliary-device container object after its release callback frees it. Under conservative kernel UAF scoring, freed slab reuse can support information disclosure, so confidentiality is High.\nI:H - The UAF lets stale object contents influence cleanup through `mana_adev_idx_free()`, and kernel UAFs are conservatively treated as potentially exploitable memory corruption. Integrity is therefore High.\nA:H - At minimum, the stale access can trigger a kernel UAF report, invalid IDA cleanup, oops, or panic during probe/resume error unwinding. Availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:37.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d88541ffd56d62a61e77209080001eddd4d69815"
        },
        {
          "url": "https://git.kernel.org/stable/c/43f5b19fd190fea20d052bc84741b28031d5baa9"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f4061f8225d18695e5afe9bbf1cb7bd673d7872"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5a75bf026c686b91a7dc6f9c5caf5016745d1fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70f"
        }
      ],
      "title": "net: mana: fix use-after-free in add_adev() error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43056",
    "datePublished": "2026-05-01T14:15:48.837Z",
    "dateReserved": "2026-05-01T14:12:55.980Z",
    "dateUpdated": "2026-08-05T12:25:37.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "348a5f8d06c7bdf954e13c17ad5f80b59a075604",
              "status": "affected",
              "version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
              "versionType": "git"
            },
            {
              "lessThan": "079986d6db1f8e3d50c55f400cf998ac9690d2c8",
              "status": "affected",
              "version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
              "versionType": "git"
            },
            {
              "lessThan": "9a9b89eea4a9cc7726702946ff688d716962fabd",
              "status": "affected",
              "version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
              "versionType": "git"
            },
            {
              "lessThan": "e123d9302d223767bd910bfbcfe607bae909f8ac",
              "status": "affected",
              "version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix RSS context delete logic\n\nWe need to free the corresponding RSS context VNIC\nin FW everytime an RSS context is deleted in driver.\nCommit 667ac333dbb7 added a check to delete the VNIC\nin FW only when netif_running() is true to help delete\nRSS contexts with interface down.\n\nHaving that condition will make the driver leak VNICs\nin FW whenever close() happens with active RSS contexts.\nOn the subsequent open(), as part of RSS context restoration,\nwe will end up trying to create extra VNICs for which we\ndid not make any reservation. FW can fail this request,\nthereby making us lose active RSS contexts.\n\nSuppose an RSS context is deleted already and we try to\nprocess a delete request again, then the HWRM functions\nwill check for validity of the request and they simply\nreturn if the resource is already freed. So, even for\ndelete-when-down cases, netif_running() check is not\nnecessary.\n\nRemove the netif_running() condition check when deleting\nan RSS context."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:21:07.350Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/348a5f8d06c7bdf954e13c17ad5f80b59a075604"
        },
        {
          "url": "https://git.kernel.org/stable/c/079986d6db1f8e3d50c55f400cf998ac9690d2c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a9b89eea4a9cc7726702946ff688d716962fabd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e123d9302d223767bd910bfbcfe607bae909f8ac"
        }
      ],
      "title": "bnxt_en: Fix RSS context delete logic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43260",
    "datePublished": "2026-05-06T11:28:48.113Z",
    "dateReserved": "2026-05-01T14:12:55.997Z",
    "dateUpdated": "2026-05-11T22:21:07.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamalg_qi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31022cfde5235c45fa765f0aabeff5f0652852f2",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "c2fb4984fe09fc176fe4c12d5e3edf626df6511d",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "aa545df011338df13f0833fc1fabcb15c0521959",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "cebc5ebd958346195b77f42d0cd5141b4e448fae",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "80688afb9c35b3934ce2d6be9973758915e2e0ef",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamalg_qi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - fix overflow on long hmac keys\n\nWhen a key longer than block size is supplied, it is copied and then\nhashed into the real key.  The memory allocated for the copy needs to\nbe rounded to DMA cache alignment, as otherwise the hashed key may\ncorrupt neighbouring memory.\n\nThe copying is performed using kmemdup, however this leads to an overflow:\nreading more bytes (aligned_len - keylen) from the keylen source buffer.\nFix this by replacing kmemdup with kmalloc, followed by memcpy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches the vulnerable CAAM HMAC `ahash_setkey` path locally through the unprivileged `AF_ALG` hash socket interface and `setsockopt(ALG_SET_KEY)`. There is no remotely supplied packet or adjacent-link protocol path that directly chooses this HMAC key.\nAC:L - The attacker directly controls the algorithm selection and long key length, and triggering only requires supplying a key longer than the hash block size on a system with the CAAM QI2 driver registered. No race or victim-controlled timing condition is required.\nPR:L - Creating and using `AF_ALG` hash sockets does not require administrative capabilities, so any local unprivileged user can invoke the setkey path. It is therefore Low privileges, not High.\nUI:N - No victim action is needed after the attacker has local code execution; the attacker can open the socket, bind the HMAC algorithm, and set the key themselves.\nS:U - The vulnerability is in kernel crypto driver handling and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate authorization boundary.\nC:H - The bug is an out-of-bounds kernel heap read from the temporary key buffer by up to DMA cache-alignment padding, and repeated attacker-controlled invocations can expose sensitive adjacent kernel memory. Under the conservative rule, this kernel OOB read is scored as High confidentiality impact.\nI:H - The affected long-key path is kernel DMA/HMAC key handling where incorrect aligned-buffer handling is associated with neighboring memory corruption, and exploitation of kernel memory-safety bugs can plausibly yield arbitrary modification or code execution. Under the required higher-severity tie-break, integrity is High.\nA:H - The overflow can trigger kernel memory safety failures such as KASAN reports, faults, oopses, or DMA-related corruption in kernel memory. This is sufficient for High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:16.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31022cfde5235c45fa765f0aabeff5f0652852f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2fb4984fe09fc176fe4c12d5e3edf626df6511d"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa545df011338df13f0833fc1fabcb15c0521959"
        },
        {
          "url": "https://git.kernel.org/stable/c/cebc5ebd958346195b77f42d0cd5141b4e448fae"
        },
        {
          "url": "https://git.kernel.org/stable/c/80688afb9c35b3934ce2d6be9973758915e2e0ef"
        }
      ],
      "title": "crypto: caam - fix overflow on long hmac keys",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43330",
    "datePublished": "2026-05-08T13:31:18.133Z",
    "dateReserved": "2026-05-01T14:12:56.002Z",
    "dateUpdated": "2026-08-05T12:27:16.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea18732d2614557e59f4c0d8cdbe6611aeab33b7",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            },
            {
              "lessThan": "d28311539ac9f65e29308ea219ecaa48aa5e76e5",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            },
            {
              "lessThan": "b6ae482f88654db407c8c17619d4b62959b903ef",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            },
            {
              "lessThan": "204028af77a265e31ceb4ba7f643349a3cca72b2",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            },
            {
              "lessThan": "01a6431766c35dfedb86e0cb5d3fc80c6d604a47",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            },
            {
              "lessThan": "e08d75753db17aa943d7622f09d9c217b5bfd3b8",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            },
            {
              "lessThan": "8c6443bb9257b780986fb67ec08565bf48ecb8d7",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            },
            {
              "lessThan": "85fa3512048793076eef658f66489112dcc91993",
              "status": "affected",
              "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in SSP passkey handlers\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise\nthe connection can be freed concurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage in both\nhandlers.\n\nKeep the existing keypress notification behavior unchanged by routing\nthe early exits through a common unlock path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:24.462Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea18732d2614557e59f4c0d8cdbe6611aeab33b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d28311539ac9f65e29308ea219ecaa48aa5e76e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6ae482f88654db407c8c17619d4b62959b903ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47"
        },
        {
          "url": "https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993"
        }
      ],
      "title": "Bluetooth: hci_event: fix potential UAF in SSP passkey handlers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46056",
    "datePublished": "2026-05-27T12:57:15.150Z",
    "dateReserved": "2026-05-13T15:03:33.094Z",
    "dateUpdated": "2026-08-05T12:29:24.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}