Vulnerability-Lookup

RHSA-2026:36018

Vulnerability from csaf_redhat - Published: 2026-07-06 21:21 - Updated: 2026-09-15 13:47

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau] [rhel-9.8.z] (JIRA:RHEL-160966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-10263

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise.

8.4 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 303 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-687.22.1.el9_8.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.22.1.el9_8.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-687.22.1.el9_8.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-uki-virt-addons-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.22.1.el9_8.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-43112

A flaw was found in the Linux kernel's CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-43276

A flaw was found in the Linux kernel's mana network driver. This vulnerability, a use-after-free, occurs when the PCI service rescan path attempts to destroy an already-freed workqueue a second time. A local attacker could exploit this condition to cause a system crash, leading to a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-46116

A flaw was found in the Linux kernel's `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-46155

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2_compound_op() function, allowing the attacker to leak sensitive kernel heap memory.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-46209

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a specially crafted Graphics Execution Manager (GEM) object that bypasses security validations. This could allow the GPU to access memory outside its designated area, potentially leading to memory corruption, information disclosure, or the execution of unauthorized code.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-46227

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A race condition exists in the `SCTP_SENDALL` path where a cached list entry is not properly revalidated after the socket lock is temporarily released. This allows a local attacker or a remote attacker (via a network abort) to trigger a use-after-free or type confusion vulnerability. Successful exploitation can lead to a controlled indirect call, potentially resulting in arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-46244

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nft_inner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset (inner_thoff) becomes desynchronized from the Layer 4 protocol (l4proto). A remote attacker could exploit this desynchronization to perform transport header forgery, potentially leading to a firewall bypass and allowing unauthorized network access.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-823 - Use of Out-of-range Pointer Offset

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-46259

A flaw was found in the Linux kernel's procfs component. When reading /proc/[pid]/stat, the do_task_stat() function accesses task->real_parent without proper Read-Copy-Update (RCU) protection. This missing protection creates a race condition, which can lead to a Use-After-Free (UAF) vulnerability. A local attacker could potentially exploit this to cause a system crash or achieve other unspecified impacts.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-820 - Missing Synchronization

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-46316

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64, specifically within the vgic-its component. This vulnerability occurs when multiple concurrent operations incorrectly drop the translation cache's reference to an entry more than once during cache invalidation. This leads to a use-after-free condition, which can result in memory corruption. The primary impact is potential system instability or a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-46323

A flaw was found in the Linux kernel's Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-123 - Write-what-where Condition

Affected products

Fixed 303 products, the same list as for CVE-2025-10263

Threats

Impact Important

References

76 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:36018	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467015	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467113	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482564	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482636	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482660	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484451	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484477	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486958	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486982	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-10263	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486958	external
https://www.cve.org/CVERecord?id=CVE-2025-10263	external
https://nvd.nist.gov/vuln/detail/CVE-2025-10263	external
https://developer.arm.com/documentation/112137	external
https://access.redhat.com/security/cve/CVE-2026-43112	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467015	external
https://www.cve.org/CVERecord?id=CVE-2026-43112	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43112	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43276	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467113	external
https://www.cve.org/CVERecord?id=CVE-2026-43276	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43276	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46116	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	external
https://www.cve.org/CVERecord?id=CVE-2026-46116	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46116	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46155	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482660	external
https://www.cve.org/CVERecord?id=CVE-2026-46155	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46155	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46209	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482636	external
https://www.cve.org/CVERecord?id=CVE-2026-46209	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46209	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46227	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482564	external
https://www.cve.org/CVERecord?id=CVE-2026-46227	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46227	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46244	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484451	external
https://www.cve.org/CVERecord?id=CVE-2026-46244	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46244	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-46259	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484477	external
https://www.cve.org/CVERecord?id=CVE-2026-46259	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46259	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-46316	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486982	external
https://www.cve.org/CVERecord?id=CVE-2026-46316	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46316	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-46323	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	external
https://www.cve.org/CVERecord?id=CVE-2026-46323	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46323	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://lore.kernel.org/netdev/4d583fc5401298453d…	external
https://lore.kernel.org/netdev/agVpIsaSherjHTYg@s…	external

JSON

To clipboard

Loading 1.2 MB of JSON…

CVE-2025-10263 (GCVE-0-2025-10263)

Vulnerability from cvelistv5 – Published: 2026-06-09 09:23 – Updated: 2026-09-04 12:04

Summary

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 14:11 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-266 - Incorrect Privilege Assignment

Assigner

Arm mitre root

References

29 references

URL	Tags
https://developer.arm.com/documentation/112137
http://xenbits.xen.org/xsa/advisory-493.html
http://www.openwall.com/lists/oss-security/2026/0…
https://access.redhat.com/security/cve/CVE-2025-10263	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486958	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:54205	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54187	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56786	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56853	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54544	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54553	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54581	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54599	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55445	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51603	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51746	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49031	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36349	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47248	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49033	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36348	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51604	vendor-advisoryx_refsource_REDHAT

Impacted products

52 products

Vendor	Product	Version
Arm	C1-Ultra	Affected: 0
Arm	C1-Premium	Affected: 0
Arm	Neoverse V3	Affected: 0
Arm	Neoverse V3AE	Affected: 0
Arm	Neoverse V1	Affected: 0
Arm	Neoverse N2	Affected: 0
Arm	Neoverse N1	Affected: 0
Arm	Cortex-X925	Affected: 0
Arm	Cortex-X4	Affected: 0
Arm	Cortex-X3	Affected: 0
Arm	Cortex-X2	Affected: 0
Arm	Cortex-X1	Affected: 0
Arm	Cortex-X1C	Affected: 0
Arm	Cortex-A710	Affected: 0
Arm	Cortex-A78	Affected: 0
Arm	Cortex-A78AE	Affected: 0
Arm	Cortex-A78C	Affected: 0
Arm	Cortex-A77	Affected: 0
Arm	Cortex-A76	Affected: 0
Arm	Cortex-A76AE	Affected: 0
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.30.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.98.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.rt7.481.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.200.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.200.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.204.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.204.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.186.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.186.1.rt14.471.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.143.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.131.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202608080425-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202608111330-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202608172040-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202608180329-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202608150307-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202608250221-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202608111829-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202608120446-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202608121719-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202608122143-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 4.22.9.8.202607152026-0 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux for NVIDIA 26	cpe:/a:redhat:enterprise_linux_nvidia:
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-09T16:53:49.813Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-493.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/09/13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-10263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T14:11:21.775441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T14:11:48.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.30.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.98.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.rt7.481.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.200.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.200.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.204.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.204.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.186.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.186.1.rt14.471.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.143.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.131.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202608080425-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202608111330-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202608172040-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202608180329-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202608150307-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202608250221-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202608111829-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202608120446-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202608121719-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202608122143-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.22.9.8.202607152026-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux for NVIDIA 26",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-09T09:23:18.802Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-266",
                "description": "Incorrect Privilege Assignment",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T12:04:56.776Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2025-10263"
          },
          {
            "name": "RHBZ#2486958",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486958"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10263.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54205"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54187"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56786"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56853"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54544"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54553"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54581"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54599"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55445"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51603"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51746"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49031"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36349"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47248"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49033"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36348"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51604"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:54205: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54187: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56786: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56911: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56853: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60019: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54544: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54553: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54581: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54599: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40764: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51603: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51746: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49031: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36349: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47248: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49033: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36348: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51604: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-09T11:01:37.157Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-09T09:23:18.802Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C1-Ultra",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "C1-Premium",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse V3",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse V3AE",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse V1",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse N2",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse N1",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X925",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X4",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X3",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X2",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X1",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X1C",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A710",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A78",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A78AE",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A78C",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A77",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A76",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A76AE",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026amp; V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026amp; X1C, Cortex-A710, Cortex-A78, A78AE \u0026amp; A78C, Cortex-A77, Cortex-A76 \u0026amp; A76A may allow writes to resources owned by a higher exception level."
            }
          ],
          "value": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026 V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026 X1C, Cortex-A710, Cortex-A78, A78AE \u0026 A78C, Cortex-A77, Cortex-A76 \u0026 A76A may allow writes to resources owned by a higher exception level."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T09:23:18.802Z",
        "orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
        "shortName": "Arm"
      },
      "references": [
        {
          "url": "https://developer.arm.com/documentation/112137"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
    "assignerShortName": "Arm",
    "cveId": "CVE-2025-10263",
    "datePublished": "2026-06-09T09:23:18.802Z",
    "dateReserved": "2025-09-11T08:50:36.018Z",
    "dateUpdated": "2026-09-04T12:04:56.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43112 (GCVE-0-2026-43112)

Vulnerability from cvelistv5 – Published: 2026-05-06 07:40 – Updated: 2026-09-15 12:04

Title

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

Summary

In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

Linux mitre root

References

36 references

URL	Tags
https://git.kernel.org/stable/c/a2ba20c17de8eb028…
https://git.kernel.org/stable/c/fbced33599653471b…
https://git.kernel.org/stable/c/5d4fe469fe7dbff7d…
https://git.kernel.org/stable/c/2d29214448ec0f4e7…
https://git.kernel.org/stable/c/86f9c23e0814cfdff…
https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a4…
https://git.kernel.org/stable/c/78ec5bf2f589ec7fd…
https://access.redhat.com/security/cve/CVE-2026-43112	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467015	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:59831	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62409	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62549	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57402	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57543	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57457	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59662	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56573	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53990	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62642	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36366	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62637	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53989	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62558	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62638	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62641	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62640	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36365	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59663	vendor-advisoryx_refsource_REDHAT

Impacted products

33 products

Vendor	Product	Version
Linux	Linux	Affected: c63433a09d6ae4c226fcbc66da4c58fc189fd746 , < a2ba20c17de8eb028f96b1d85f119d3d25655bd9 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < fbced33599653471b4581dfe1abc7b467031f126 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 5d4fe469fe7dbff7d874c196bb680a82f2625d95 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 86f9c23e0814cfdffda9eedf0c591c51ba209010 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 78ec5bf2f589ec7fd8f169394bfeca541b077317 (git) Affected: 5.15.11 , < 5.15.209 (semver)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.30.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.95.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.141.1.rt7.482.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.141.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.206.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.206.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.188.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.188.1.rt14.473.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.145.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.134.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202608241157-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202609011112-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202608250221-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202608182320-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202608181658-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202608180431-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 4.22.9.8.202607152026-0 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.30.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.95.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.141.1.rt7.482.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.141.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.206.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.206.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.188.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.188.1.rt14.473.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.145.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.134.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202608241157-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202609011112-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202608250221-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202608182320-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202608181658-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202608180431-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.22.9.8.202607152026-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-06T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:23.510Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43112"
          },
          {
            "name": "RHBZ#2467015",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43112.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59831"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62409"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62549"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57402"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57543"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57457"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59662"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56573"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53990"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62642"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36366"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62637"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53989"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62558"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62638"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62641"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62640"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36365"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59663"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:59831: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62409: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62549: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60019: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57402: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57543: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57457: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40764: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52764: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59662: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56573: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53990: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62642: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36366: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62637: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53989: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62558: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62638: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62639: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62641: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62640: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36365: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59663: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent the `cifs` kernel module from loading if CIFS client functionality is not required. This can be achieved by blacklisting the module.\n\nCreate a file named `/etc/modprobe.d/blacklist-cifs.conf` with the following content:\n```\nblacklist cifs\n```\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect.\n```bash\ndracut -f -v\nreboot\n```\nDisabling the `cifs` module will prevent the system from mounting CIFS network shares, which may impact functionality relying on this protocol."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a2ba20c17de8eb028f96b1d85f119d3d25655bd9",
              "status": "affected",
              "version": "c63433a09d6ae4c226fcbc66da4c58fc189fd746",
              "versionType": "git"
            },
            {
              "lessThan": "fbced33599653471b4581dfe1abc7b467031f126",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "5d4fe469fe7dbff7d874c196bb680a82f2625d95",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "86f9c23e0814cfdffda9eedf0c591c51ba209010",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "78ec5bf2f589ec7fd8f169394bfeca541b077317",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.209",
              "status": "affected",
              "version": "5.15.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.15.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n\nWhen cifs_sanitize_prepath is called with an empty string or a string\ncontaining only delimiters (e.g., \"/\"), the current logic attempts to\ncheck *(cursor2 - 1) before cursor2 has advanced. This results in an\nout-of-bounds read.\n\nThis patch adds an early exit check after stripping prepended\ndelimiters. If no path content remains, the function returns NULL.\n\nThe bug was identified via manual audit and verified using a\nstandalone test case compiled with AddressSanitizer, which\ntriggered a SEGV on affected inputs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious SMB/DFS server can influence referral target path handling that flows through SMB client mount/DFS processing into `cifs_sanitize_prepath`. The triggering data is delivered over the network via SMB responses.\nAC:L - The trigger is a deterministic empty or delimiter-only prepath condition; no race or hard-to-control environmental condition is required. A malicious server or local mount caller can craft the relevant path form directly.\nPR:N - In the network scenario, the attacker only needs to operate the SMB/DFS endpoint that the victim client contacts and needs no privileges on the victim system. Local user-namespace reachability also exists before the final non-`FS_USERNS_MOUNT` mount denial, but the no-privilege malicious-server scenario is more severe.\nUI:R - The victim must initiate or otherwise cause an SMB/CIFS mount or DFS traversal to the attacker-controlled server. After that action, no further interaction is needed.\nS:U - The bug corrupts or reads kernel memory within the same host kernel security authority. It does not cross a separate scope such as a hypervisor, guest boundary, or IOMMU boundary.\nC:H - The immediate invalid access is a bounded read, but the same edge case can enter a path that treats memory before the prepath as part of the buffer, making this defensibly kernel memory corruption. Under the required overestimation rule, potential exploitation of kernel memory corruption is scored as high confidentiality impact.\nI:H - After the out-of-bounds read, if the preceding byte is a delimiter the old code decrements the cursor and writes a NUL before the prepath buffer. That conditional out-of-bounds write is kernel memory corruption and is scored as high integrity impact.\nA:H - The fix commit reports an AddressSanitizer SEGV on affected inputs, and the kernel path can produce invalid memory access or heap corruption. A repeatable kernel oops/panic or destabilization is therefore a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:59.624Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439"
        },
        {
          "url": "https://git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010"
        },
        {
          "url": "https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317"
        }
      ],
      "title": "fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43112",
    "datePublished": "2026-05-06T07:40:38.563Z",
    "dateReserved": "2026-05-01T14:12:55.986Z",
    "dateUpdated": "2026-09-15T12:04:23.510Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43276 (GCVE-0-2026-43276)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-05-11 22:21

Title

net: mana: Fix double destroy_workqueue on service rescan PCI path

Summary

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction. Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026] <TASK> [Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 [Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] [Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 [Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 [Sat Feb 21 18:53:48 2026] </TASK>

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/fa3c2f8d9152344a4…
https://git.kernel.org/stable/c/a9a7c3203fdc4d4a8…
https://git.kernel.org/stable/c/f975a0955276579e2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 505cc26bcae00699bacaee66cd50ede7a9cc89cb , < fa3c2f8d9152344a478abb847081c1b5f84a94f5 (git) Affected: 505cc26bcae00699bacaee66cd50ede7a9cc89cb , < a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e (git) Affected: 505cc26bcae00699bacaee66cd50ede7a9cc89cb , < f975a0955276579e2176a134366ed586071c7c6a (git)
Linux	Linux	Affected: 6.16 Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/gdma_main.c",
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa3c2f8d9152344a478abb847081c1b5f84a94f5",
              "status": "affected",
              "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb",
              "versionType": "git"
            },
            {
              "lessThan": "a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e",
              "status": "affected",
              "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb",
              "versionType": "git"
            },
            {
              "lessThan": "f975a0955276579e2176a134366ed586071c7c6a",
              "status": "affected",
              "version": "505cc26bcae00699bacaee66cd50ede7a9cc89cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/gdma_main.c",
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix double destroy_workqueue on service rescan PCI path\n\nWhile testing corner cases in the driver, a use-after-free crash\nwas found on the service rescan PCI path.\n\nWhen mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()\ndestroys gc-\u003eservice_wq. If the subsequent mana_gd_resume() fails\nwith -ETIMEDOUT or -EPROTO, the code falls through to\nmana_serv_rescan() which triggers pci_stop_and_remove_bus_device().\nThis invokes the PCI .remove callback (mana_gd_remove), which calls\nmana_gd_cleanup() a second time, attempting to destroy the already-\nfreed workqueue. Fix this by NULL-checking gc-\u003eservice_wq in\nmana_gd_cleanup() and setting it to NULL after destruction.\n\nCall stack of issue for reference:\n[Sat Feb 21 18:53:48 2026] Call Trace:\n[Sat Feb 21 18:53:48 2026]  \u003cTASK\u003e\n[Sat Feb 21 18:53:48 2026]  mana_gd_cleanup+0x33/0x70 [mana]\n[Sat Feb 21 18:53:48 2026]  mana_gd_remove+0x3a/0xc0 [mana]\n[Sat Feb 21 18:53:48 2026]  pci_device_remove+0x41/0xb0\n[Sat Feb 21 18:53:48 2026]  device_remove+0x46/0x70\n[Sat Feb 21 18:53:48 2026]  device_release_driver_internal+0x1e3/0x250\n[Sat Feb 21 18:53:48 2026]  device_release_driver+0x12/0x20\n[Sat Feb 21 18:53:48 2026]  pci_stop_bus_device+0x6a/0x90\n[Sat Feb 21 18:53:48 2026]  pci_stop_and_remove_bus_device+0x13/0x30\n[Sat Feb 21 18:53:48 2026]  mana_do_service+0x180/0x290 [mana]\n[Sat Feb 21 18:53:48 2026]  mana_serv_func+0x24/0x50 [mana]\n[Sat Feb 21 18:53:48 2026]  process_one_work+0x190/0x3d0\n[Sat Feb 21 18:53:48 2026]  worker_thread+0x16e/0x2e0\n[Sat Feb 21 18:53:48 2026]  kthread+0xf7/0x130\n[Sat Feb 21 18:53:48 2026]  ? __pfx_worker_thread+0x10/0x10\n[Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026]  ret_from_fork+0x269/0x350\n[Sat Feb 21 18:53:48 2026]  ? __pfx_kthread+0x10/0x10\n[Sat Feb 21 18:53:48 2026]  ret_from_fork_asm+0x1a/0x30\n[Sat Feb 21 18:53:48 2026]  \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:21:25.701Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa3c2f8d9152344a478abb847081c1b5f84a94f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f975a0955276579e2176a134366ed586071c7c6a"
        }
      ],
      "title": "net: mana: Fix double destroy_workqueue on service rescan PCI path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43276",
    "datePublished": "2026-05-06T11:28:58.840Z",
    "dateReserved": "2026-05-01T14:12:55.998Z",
    "dateUpdated": "2026-05-11T22:21:25.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46116 (GCVE-0-2026-46116)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-09-15 12:04

Title

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

Summary

In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being: BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline] BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435 Workqueue: netns cleanup_net Call Trace: __hlist_del / hlist_del_rcu __xfrm_state_delete xfrm_state_delete xfrm_state_flush xfrm_state_fini ops_exit_list cleanup_net The other observed signatures hit the same slab object from __xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB write variant of __xfrm_state_delete, all on the byseq/byspi hash chains. __xfrm_state_delete() guards its byseq and byspi unhashes with value-based predicates: if (x->km.seq) hlist_del_rcu(&x->byseq); if (x->id.spi) hlist_del_rcu(&x->byspi); while everywhere else in the file (e.g. state_cache, state_cache_input) the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets x->id.spi = newspi inside xfrm_state_lock and then immediately inserts into byspi, but a path that observes x->id.spi != 0 outside of xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently with whether x is actually on the list. The same holds for x->km.seq versus byseq, and the bydst/bysrc unhashes have no predicate at all, so a second __xfrm_state_delete() on the same object writes through LIST_POISON pprev. The defensive change here: - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst, bysrc, byseq and byspi so a second deletion is a no-op rather than a write through LIST_POISON pprev. The byseq/byspi nodes are already initialised in xfrm_state_alloc(). - Test hlist_unhashed() rather than the value predicate for byseq/byspi, so the unhash decision tracks list state rather than mutable scalar fields. Empirical verification: applied this patch on top of v6.12.47, rebuilt, and re-ran the same syzkaller harness for 1h16m on a previously-crashy configuration that produced ~100 hits each of slab-use-after-free Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in __xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at ~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo confirms the xfrm_state slab is actively allocated and freed during the run (~143 KiB resident), so the fuzzer is still exercising those code paths -- they just no longer crash. Reproduction: - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal - 9 unique signatures collected in ~9h, all within xfrm_state lifecycle

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-763 - Release of Invalid Pointer or Reference

Assigner

Linux mitre root

References

33 references

URL	Tags
https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5…
https://git.kernel.org/stable/c/3943fcad7694a7d0b…
https://git.kernel.org/stable/c/2c617848ae6e4f07a…
https://git.kernel.org/stable/c/b4a53add2fa8f1b5a…
https://git.kernel.org/stable/c/26edb0a3c99f9d958…
https://git.kernel.org/stable/c/4980162de555cb838…
https://git.kernel.org/stable/c/a2e2d08fb070fab49…
https://git.kernel.org/stable/c/14acf9652e5690de3…
https://access.redhat.com/security/cve/CVE-2026-46116	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41235	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41234	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39371	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42919	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47739	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43231	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44385	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59143	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39179	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59146	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47633	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49033	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47869	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59142	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59147	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59145	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59148	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59149	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39180	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47632	vendor-advisoryx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…

Impacted products

30 products

Vendor	Product	Version
Linux	Linux	Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 2c617848ae6e4f07a3e397f604208c293bbecacc (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < b4a53add2fa8f1b5aa17d4c5686c320785fab182 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 26edb0a3c99f9d958c212be68b21f1221614dcf0 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 4980162de555cb838f1a189ce7d2cbf5d2e7b050 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < a2e2d08fb070fab4947447171f1c4e3ca5a188e5 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 14acf9652e5690de3c7486c6db5fb8dafd0a32a3 (git)
Linux	Linux	Affected: 2.6.19 Unaffected: 0 , < 2.6.19 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.37.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.88.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.156.1.rt56.1308.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.156.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.144.1.rt7.485.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.144.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.199.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.199.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.204.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.204.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.156.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.156.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.183.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.183.1.rt14.468.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.139.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.129.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.37.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.88.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.156.1.rt56.1308.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.156.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.144.1.rt7.485.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.144.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.199.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.199.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.204.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.204.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.156.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.156.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.183.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.183.1.rt14.468.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.139.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.129.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-28T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-763",
                "description": "Release of Invalid Pointer or Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:30.024Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46116"
          },
          {
            "name": "RHBZ#2482523",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482523"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41235"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41234"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39371"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42919"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47739"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43231"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44385"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59143"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39179"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59146"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47633"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49033"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47869"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59147"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59145"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59148"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59149"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39180"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47632"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41235: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41234: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39371: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47739: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43231: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44385: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59143: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39179: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59146: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47633: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49033: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47869: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59142: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59147: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59145: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59148: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59149: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39180: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47632: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:17.291Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "2c617848ae6e4f07a3e397f604208c293bbecacc",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "b4a53add2fa8f1b5aa17d4c5686c320785fab182",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "26edb0a3c99f9d958c212be68b21f1221614dcf0",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "4980162de555cb838f1a189ce7d2cbf5d2e7b050",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "a2e2d08fb070fab4947447171f1c4e3ca5a188e5",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "14acf9652e5690de3c7486c6db5fb8dafd0a32a3",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()\u0027s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n  BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n  BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n  BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n  Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n  Workqueue: netns cleanup_net\n  Call Trace:\n   __hlist_del / hlist_del_rcu\n   __xfrm_state_delete\n   xfrm_state_delete\n   xfrm_state_flush\n   xfrm_state_fini\n   ops_exit_list\n   cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x-\u003ekm.seq)\n\t\thlist_del_rcu(\u0026x-\u003ebyseq);\n\tif (x-\u003eid.spi)\n\t\thlist_del_rcu(\u0026x-\u003ebyspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx-\u003eid.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x-\u003eid.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x-\u003ekm.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n  - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n    bysrc, byseq and byspi so a second deletion is a no-op rather\n    than a write through LIST_POISON pprev. The byseq/byspi nodes\n    are already initialised in xfrm_state_alloc().\n  - Test hlist_unhashed() rather than the value predicate for\n    byseq/byspi, so the unhash decision tracks list state rather than\n    mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n  - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n  - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n  - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n  - 9 unique signatures collected in ~9h, all within xfrm_state\n    lifecycle"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The xfrm_state lifecycle is reached through the NETLINK_XFRM and PF_KEY socket interfaces (local syscalls); the freed object and the race are set up by the attacker\u0027s local state-management operations, not by remote packets.\nAC:L - Although it is a race/double-free, the attacker controls all racing actors (concurrent DELSA/ALLOCSPI/FLUSHSA threads plus namespace teardown they trigger) and can repeat indefinitely; syzkaller hit it ~100 times per hour, so a targeted trigger is reliable.\nPR:L - All xfrm operations require CAP_NET_ADMIN, but the check is against the netns user namespace, so an unprivileged user obtains it via `unshare -Urn` and exercises the per-netns xfrm_state path.\nUI:N - The attacker performs all state creation, deletion and namespace teardown itself; no victim action is required.\nS:U - The corruption is confined to the kernel\u0027s own slab memory within the same security authority; it is not a hypervisor or IOMMU boundary crossing.\nC:H - The slab-use-after-free gives the attacker control over freed xfrm_state contents and read-UAF sites (xfrm_alloc_spi/__xfrm_state_lookup), enabling arbitrary kernel memory disclosure.\nI:H - The UAF/OOB writes an attacker-influenced 8-byte list pointer into freed/adjacent slab memory, providing a heap write primitive leveragable for arbitrary write and control-flow hijack.\nA:H - The slab-use-after-free and out-of-bounds writes corrupt kernel hash chains, reliably causing oops/panic and bringing the kernel down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:48.359Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182"
        },
        {
          "url": "https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3"
        }
      ],
      "title": "xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46116",
    "datePublished": "2026-05-28T09:35:30.689Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-09-15T12:04:30.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46155 (GCVE-0-2026-46155)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:36 – Updated: 2026-08-05 12:30

Title

smb/client: fix out-of-bounds read in smb2_compound_op()

Summary

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/dffb44b2e06a2908e…
https://git.kernel.org/stable/c/9b3af35645ff9cd33…
https://git.kernel.org/stable/c/512d33bc8ea4ea5c1…
https://git.kernel.org/stable/c/a16f70a71be4b5a4e…
https://git.kernel.org/stable/c/8d09328dfda089675…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7449d736bbbd160c76b01b8fcdf72f58a8757d4b , < dffb44b2e06a2908e249f0f93156fc987eee1d1c (git) Affected: ea41367b2a602f602ea6594fc4a310520dcc64f4 , < 9b3af35645ff9cd334edc130249f9a2fb2bea25f (git) Affected: ea41367b2a602f602ea6594fc4a310520dcc64f4 , < 512d33bc8ea4ea5c19728ee118715f4b1f4d1926 (git) Affected: ea41367b2a602f602ea6594fc4a310520dcc64f4 , < a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c (git) Affected: ea41367b2a602f602ea6594fc4a310520dcc64f4 , < 8d09328dfda089675e4c049f3f256064a1d1996b (git) Affected: 6.6.32 , < 6.6.140 (semver)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dffb44b2e06a2908e249f0f93156fc987eee1d1c",
              "status": "affected",
              "version": "7449d736bbbd160c76b01b8fcdf72f58a8757d4b",
              "versionType": "git"
            },
            {
              "lessThan": "9b3af35645ff9cd334edc130249f9a2fb2bea25f",
              "status": "affected",
              "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4",
              "versionType": "git"
            },
            {
              "lessThan": "512d33bc8ea4ea5c19728ee118715f4b1f4d1926",
              "status": "affected",
              "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4",
              "versionType": "git"
            },
            {
              "lessThan": "a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c",
              "status": "affected",
              "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4",
              "versionType": "git"
            },
            {
              "lessThan": "8d09328dfda089675e4c049f3f256064a1d1996b",
              "status": "affected",
              "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.140",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix out-of-bounds read in smb2_compound_op()\n\nIf a server sends a truncated response but a large OutputBufferLength, and\nterminates the EA list early, check_wsl_eas() returns success without\nvalidating that the entire OutputBufferLength fits within iov_len.\n\nThen smb2_compound_op() does:\n    memcpy(idata-\u003ewsl.eas, data[0], size[0]);\n\nWhere size[0] is OutputBufferLength. If iov_len is smaller than size[0],\nmemcpy can read beyond the end of the rsp_iov allocation and leak adjacent\nkernel heap memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the in-kernel SMB client processing a response from a remote SMB server over TCP/445; the out-of-bounds read is driven entirely by attacker-controlled data received from a remote peer.\nAC:L - A malicious server reliably and deterministically crafts the triggering response (truncated payload with a large OutputBufferLength and early-terminated EA list); there is no race or uncontrolled memory-layout condition required to cause the OOB read.\nPR:N - The attacker is the remote SMB server (or a network MITM) and needs no privileges or account on the victim client system to send the malicious response.\nUI:N - On an already-mounted share served by a compromised/malicious server or via MITM, the vulnerable WSL-EA query fires during routine stat/readdir on reparse-point files with no deliberate victim action, consistent with the sibling CVE-2026-46185.\nS:U - The leak is confined to the kernel\u0027s own security authority and exposed to local processes; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The memcpy reads adjacent kernel heap memory (up to tens of bytes) into wsl.eas, and crafted EA value fields cause that leaked kernel data to be reflected to userspace as the file\u0027s uid/gid/mode/device via stat().\nI:N - The flaw is a pure out-of-bounds read; the destination buffer is size-bounded (outlen \u2264 MAX) so no kernel memory is written or corrupted, providing no integrity/write primitive.\nA:H - The out-of-bounds read can cross into an unmapped page (and traps under KASAN), producing a kernel oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:06.776Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dffb44b2e06a2908e249f0f93156fc987eee1d1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b3af35645ff9cd334edc130249f9a2fb2bea25f"
        },
        {
          "url": "https://git.kernel.org/stable/c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926"
        },
        {
          "url": "https://git.kernel.org/stable/c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d09328dfda089675e4c049f3f256064a1d1996b"
        }
      ],
      "title": "smb/client: fix out-of-bounds read in smb2_compound_op()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46155",
    "datePublished": "2026-05-28T09:36:11.092Z",
    "dateReserved": "2026-05-13T15:03:33.102Z",
    "dateUpdated": "2026-08-05T12:30:06.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46209 (GCVE-0-2026-46209)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:40 – Updated: 2026-08-05 12:30

Title

drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height / (i ? info->vsub : 1); However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses drm_format_info_plane_width/height() which round up dimensions via DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object size check for certain pixel format and dimension combinations. For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the GEM size validation path sees height=0 instead of height=1. The expression (height - 1) then wraps to UINT_MAX as an unsigned int, causing min_size to overflow and wrap back to a small value. A tiny GEM object therefore passes the size guard, yet when the GPU accesses the chroma plane it will read or write memory beyond the object's bounds. Fix by replacing the open-coded divisions with drm_format_info_plane_width() and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match the calculation already used in framebuffer_check().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/11427ad6c9f0def5c…
https://git.kernel.org/stable/c/adfc5ba4ef4dd2bca…
https://git.kernel.org/stable/c/22922f7dae74409fc…
https://git.kernel.org/stable/c/6b992591e04f2cce8…
https://git.kernel.org/stable/c/1da4ab7189f1064b3…
https://git.kernel.org/stable/c/1a17ea9861e895853…
https://git.kernel.org/stable/c/c5fc49d8470c5ebf3…
https://git.kernel.org/stable/c/3d4c2268bd7243c37…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < 11427ad6c9f0def5ce567982b785da3191946430 (git) Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < adfc5ba4ef4dd2bca5969f40e8fc7b41fb3902ad (git) Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < 22922f7dae74409fc4bf0f1142710cb6b8ce8cc2 (git) Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < 6b992591e04f2cce813bcf239b354f375bbf84d3 (git) Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < 1da4ab7189f1064b3b712b388772c008b4d82580 (git) Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < 1a17ea9861e89585361caa8bc231bd22dc6dbe7d (git) Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < c5fc49d8470c5ebf3b41607600f277158f159950 (git) Affected: 4c3dbb2c312c9fafbac30d98c523b8b1f3455d78 , < 3d4c2268bd7243c3780fe32bf24ff876da272acf (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.90 , ≤ 6.12.* (semver) Unaffected: 6.18.32 , ≤ 6.18.* (semver) Unaffected: 7.0.9 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem_framebuffer_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11427ad6c9f0def5ce567982b785da3191946430",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            },
            {
              "lessThan": "adfc5ba4ef4dd2bca5969f40e8fc7b41fb3902ad",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            },
            {
              "lessThan": "22922f7dae74409fc4bf0f1142710cb6b8ce8cc2",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            },
            {
              "lessThan": "6b992591e04f2cce813bcf239b354f375bbf84d3",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            },
            {
              "lessThan": "1da4ab7189f1064b3b712b388772c008b4d82580",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            },
            {
              "lessThan": "1a17ea9861e89585361caa8bc231bd22dc6dbe7d",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            },
            {
              "lessThan": "c5fc49d8470c5ebf3b41607600f277158f159950",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            },
            {
              "lessThan": "3d4c2268bd7243c3780fe32bf24ff876da272acf",
              "status": "affected",
              "version": "4c3dbb2c312c9fafbac30d98c523b8b1f3455d78",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem_framebuffer_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()\n\ndrm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions\nusing plain integer division:\n\n  unsigned int width  = mode_cmd-\u003ewidth  / (i ? info-\u003ehsub : 1);\n  unsigned int height = mode_cmd-\u003eheight / (i ? info-\u003evsub : 1);\n\nHowever, the ioctl-level framebuffer_check() in drm_framebuffer.c uses\ndrm_format_info_plane_width/height() which round up dimensions via\nDIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object\nsize check for certain pixel format and dimension combinations.\n\nFor example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the\nGEM size validation path sees height=0 instead of height=1. The\nexpression (height - 1) then wraps to UINT_MAX as an unsigned int,\ncausing min_size to overflow and wrap back to a small value. A tiny\nGEM object therefore passes the size guard, yet when the GPU accesses\nthe chroma plane it will read or write memory beyond the object\u0027s\nbounds.\n\nFix by replacing the open-coded divisions with drm_format_info_plane_width()\nand drm_format_info_plane_height(), which use DIV_ROUND_UP() and match\nthe calculation already used in framebuffer_check()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via the local DRM_IOCTL_MODE_ADDFB2 ioctl on /dev/dri/cardN; there is no network path.\nAC:L - The attacker fully controls pixel format, dimensions, pitch, offset, and GEM object size, so the integer underflow and undersized-object bypass are triggered deterministically.\nPR:L - ADDFB2 carries no DRM_MASTER/root flag, so any local unprivileged user with access to the primary DRM node can create the malformed framebuffer and (as session master on their own VT) drive the OOB access.\nUI:N - No victim interaction is required; the attacker creates and uses the framebuffer entirely on their own.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory authority with no crossing of a security boundary such as a VM or IOMMU domain.\nC:H - GPU access to the undersized chroma plane reads adjacent memory over an attacker-controlled, potentially large span, exposing kernel/GPU-visible memory contents.\nI:H - The same out-of-bounds chroma access can write past the GEM object, corrupting adjacent memory and providing a controllable write primitive.\nA:H - Out-of-bounds reads/writes of GPU-accessible memory readily cause kernel oops/panic, yielding a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:30.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11427ad6c9f0def5ce567982b785da3191946430"
        },
        {
          "url": "https://git.kernel.org/stable/c/adfc5ba4ef4dd2bca5969f40e8fc7b41fb3902ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/22922f7dae74409fc4bf0f1142710cb6b8ce8cc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b992591e04f2cce813bcf239b354f375bbf84d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1da4ab7189f1064b3b712b388772c008b4d82580"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a17ea9861e89585361caa8bc231bd22dc6dbe7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5fc49d8470c5ebf3b41607600f277158f159950"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d4c2268bd7243c3780fe32bf24ff876da272acf"
        }
      ],
      "title": "drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46209",
    "datePublished": "2026-05-28T09:40:27.092Z",
    "dateReserved": "2026-05-13T15:03:33.105Z",
    "dateUpdated": "2026-08-05T12:30:30.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46227 (GCVE-0-2026-46227)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:40 – Updated: 2026-08-25 12:05

Title

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep->asocs), and optionally close the new socket which frees the association via kfree_rcu(). The cached @tmp can also be freed by a network ABORT for that association, processed in softirq while the lock is dropped. sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing revalidates @tmp. After a successful return, the iterator advances to the stale @tmp, yielding either a use-after-free (if the peeled socket was closed) or a list-walk onto the new endpoint's list head (type confusion of &newep->asocs as a struct sctp_association *). Both are reachable from CapEff=0; the type-confusion path gives controlled indirect call via the outqueue.sched->init_sid pointer. Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() returns. @asoc is known to still be on ep->asocs at that point: the only callers that list_del an association from ep->asocs are sctp_association_free() (which sets asoc->base.dead) and sctp_assoc_migrate() (which changes asoc->base.sk), and sctp_wait_for_sndbuf() checks both under the lock before any successful return; a tripped check propagates as err < 0 and the loop bails before the re-derive. The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by list_for_each_entry_safe() still covers the lock-held free that ba59fb027307 ("sctp: walk the list of asoc safely") was added for.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

Linux mitre root

References

30 references

URL	Tags
https://git.kernel.org/stable/c/f3a3f0b406b4b7eb3…
https://git.kernel.org/stable/c/0dbc8cde64280fc37…
https://git.kernel.org/stable/c/0c7b55974f97b78d1…
https://git.kernel.org/stable/c/1bfb06ecb00f7fdf3…
https://git.kernel.org/stable/c/6187a172d6ed57d6b…
https://git.kernel.org/stable/c/c9dadb31f36045a8c…
https://git.kernel.org/stable/c/bf0f40d8107e2ce82…
https://git.kernel.org/stable/c/abb5f36771cc4c058…
https://access.redhat.com/security/cve/CVE-2026-46227	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2482564	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:27731	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36956	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26515	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27735	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34094	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59143	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36349	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59146	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26535	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33899	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26563	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59142	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59147	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59145	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59148	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59149	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36348	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26462	vendor-advisoryx_refsource_REDHAT

Impacted products

19 products

Vendor	Product	Version
Linux	Linux	Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < f3a3f0b406b4b7eb3cea35a23fa2bf170848b104 (git) Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < 0dbc8cde64280fc37cdd678cced34eaf96cfb197 (git) Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < 0c7b55974f97b78d1109025eadf084e74cbf330f (git) Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < 1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078 (git) Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < 6187a172d6ed57d6b2c327836e4407c6456e639d (git) Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < c9dadb31f36045a8cb65df4bd75e7237ef21a4b5 (git) Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < bf0f40d8107e2ce827521968dc6926f3e13728ae (git) Affected: 4910280503f3af2857d5aa77e35b22d93a8960a8 , < abb5f36771cc4c05899b34000829a787572a8817 (git)
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.90 , ≤ 6.12.* (semver) Unaffected: 6.18.32 , ≤ 6.18.* (semver) Unaffected: 7.0.9 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.32.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.82.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.rt7.481.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.194.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.194.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.198.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.198.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.147.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.147.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.176.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.176.1.rt14.461.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.132.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.125.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.32.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.82.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.rt7.481.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.194.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.194.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.198.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.198.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.147.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.147.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.176.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.176.1.rt14.461.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.132.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.125.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-28T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. A race condition exists in the `SCTP_SENDALL` path where a cached list entry is not properly revalidated after the socket lock is temporarily released. This allows a local attacker or a remote attacker (via a network abort) to trigger a use-after-free or type confusion vulnerability. Successful exploitation can lead to a controlled indirect call, potentially resulting in arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T12:05:41.607Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46227"
          },
          {
            "name": "RHBZ#2482564",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482564"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46227.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27731"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36956"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26515"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27735"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34094"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59143"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36349"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59146"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26535"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33899"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26563"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59147"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59145"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59148"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59149"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36348"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26462"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36956: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26515: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27735: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59143: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36349: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59146: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26535: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33899: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26563: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59142: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59147: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59145: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59148: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59149: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36348: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26462: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent module sctp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3a3f0b406b4b7eb3cea35a23fa2bf170848b104",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            },
            {
              "lessThan": "0dbc8cde64280fc37cdd678cced34eaf96cfb197",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            },
            {
              "lessThan": "0c7b55974f97b78d1109025eadf084e74cbf330f",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            },
            {
              "lessThan": "1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            },
            {
              "lessThan": "6187a172d6ed57d6b2c327836e4407c6456e639d",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            },
            {
              "lessThan": "c9dadb31f36045a8cb65df4bd75e7237ef21a4b5",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            },
            {
              "lessThan": "bf0f40d8107e2ce827521968dc6926f3e13728ae",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            },
            {
              "lessThan": "abb5f36771cc4c05899b34000829a787572a8817",
              "status": "affected",
              "version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL\n\nThe SCTP_SENDALL path in sctp_sendmsg() iterates ep-\u003easocs with\nlist_for_each_entry_safe(), which caches the next entry in @tmp before\nthe loop body runs.  The body calls sctp_sendmsg_to_asoc(), which may\ndrop the socket lock inside sctp_wait_for_sndbuf().\n\nWhile the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the\nassociation cached in @tmp, migrating it to a new endpoint via\nsctp_sock_migrate() (list_del_init() + list_add_tail() to\nnewep-\u003easocs), and optionally close the new socket which frees the\nassociation via kfree_rcu().  The cached @tmp can also be freed by a\nnetwork ABORT for that association, processed in softirq while the\nlock is dropped.\n\nsctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock\nvia the \"sk != asoc-\u003ebase.sk\" and \"asoc-\u003ebase.dead\" checks, but nothing\nrevalidates @tmp.  After a successful return, the iterator advances to\nthe stale @tmp, yielding either a use-after-free (if the peeled socket\nwas closed) or a list-walk onto the new endpoint\u0027s list head (type\nconfusion of \u0026newep-\u003easocs as a struct sctp_association *).\n\nBoth are reachable from CapEff=0; the type-confusion path gives\ncontrolled indirect call via the outqueue.sched-\u003einit_sid pointer.\n\nFix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc()\nreturns.  @asoc is known to still be on ep-\u003easocs at that point: the\nonly callers that list_del an association from ep-\u003easocs are\nsctp_association_free() (which sets asoc-\u003ebase.dead) and\nsctp_assoc_migrate() (which changes asoc-\u003ebase.sk), and\nsctp_wait_for_sndbuf() checks both under the lock before any\nsuccessful return; a tripped check propagates as err \u003c 0 and the loop\nbails before the re-derive.\n\nThe SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the\nloop hits \u0027continue\u0027 before sctp_sendmsg_to_asoc() is ever called, so\nthe @tmp cached by list_for_each_entry_safe() still covers the\nlock-held free that ba59fb027307 (\"sctp: walk the list of asoc\nsafely\") was added for."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached via the sendmsg() syscall on a local SCTP socket, and the racing operation (SCTP_SOCKOPT_PEELOFF + close) is likewise a local syscall; no remote packet directly reaches the bug, so local access is required.\nAC:L - The attacker controls both sides of the race \u2014 shrinking SO_SNDBUF on its own socket reliably forces sctp_wait_for_sndbuf() to drop the lock and sleep, while a second thread peels off and closes the cached next association; per guidance an attacker-controlled race is Low.\nPR:L - The commit states both the UAF and type-confusion paths are \"reachable from CapEff=0\"; creating SCTP sockets and using sendmsg/PEELOFF requires no privileges, only a basic unprivileged local user.\nUI:N - The attacker performs all sendmsg, peeloff, and close operations itself; no victim action is required.\nS:U - The corruption (UAF / type confusion) stays within the kernel\u0027s own security authority and does not cross into a separate domain such as a VM host or IOMMU boundary.\nC:H - The use-after-free gives the attacker control over freed object contents and the type confusion reinterprets a list head as an association, both of which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The type-confusion path yields a controlled indirect call via the outqueue.sched-\u003einit_sid function pointer, providing a control-flow hijack / arbitrary-write-grade primitive for privilege escalation.\nA:H - Both the use-after-free and the type-confusion list walk readily cause kernel oops/panic, giving full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:36.059Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3a3f0b406b4b7eb3cea35a23fa2bf170848b104"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dbc8cde64280fc37cdd678cced34eaf96cfb197"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c7b55974f97b78d1109025eadf084e74cbf330f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078"
        },
        {
          "url": "https://git.kernel.org/stable/c/6187a172d6ed57d6b2c327836e4407c6456e639d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9dadb31f36045a8cb65df4bd75e7237ef21a4b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf0f40d8107e2ce827521968dc6926f3e13728ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/abb5f36771cc4c05899b34000829a787572a8817"
        }
      ],
      "title": "sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46227",
    "datePublished": "2026-05-28T09:40:47.518Z",
    "dateReserved": "2026-05-13T15:03:33.106Z",
    "dateUpdated": "2026-08-25T12:05:41.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46244 (GCVE-0-2026-46244)

Vulnerability from cvelistv5 – Published: 2026-06-03 15:48 – Updated: 2026-08-19 12:05

Title

netfilter: nft_inner: Fix IPv6 inner_thoff desync

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE

CWE-823 - Use of Out-of-range Pointer Offset

Assigner

Linux mitre root

References

16 references

URL	Tags
https://git.kernel.org/stable/c/c161ad9157f5a0429…
https://git.kernel.org/stable/c/870d59e2cf218e741…
https://git.kernel.org/stable/c/689bbf48c1f451300…
https://git.kernel.org/stable/c/d0f98a3617f6ae5b1…
https://git.kernel.org/stable/c/b6a91f68ebfed9c38…
https://access.redhat.com/security/cve/CVE-2026-46244	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2484451	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:33215	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34443	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34094	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55618	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56225	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55763	vendor-advisoryx_refsource_REDHAT

Impacted products

13 products

Vendor	Product	Version
Linux	Linux	Affected: 3a07327d10a09379315c844c63f27941f5081e0a , < c161ad9157f5a0429b5ff94d9770faf3bf48d273 (git) Affected: 3a07327d10a09379315c844c63f27941f5081e0a , < 870d59e2cf218e7418491e26bad768cb16654582 (git) Affected: 3a07327d10a09379315c844c63f27941f5081e0a , < 689bbf48c1f45130086ae1c46ab83ea4c753c601 (git) Affected: 3a07327d10a09379315c844c63f27941f5081e0a , < d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce (git) Affected: 3a07327d10a09379315c844c63f27941f5081e0a , < b6a91f68ebfed9c38e0e9150f58a9b85da07181c (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.30.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.84.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.135.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.125.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.30.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.84.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.135.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.125.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-03T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s netfilter subsystem, specifically within the nft_inner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset (inner_thoff) becomes desynchronized from the Layer 4 protocol (l4proto). A remote attacker could exploit this desynchronization to perform transport header forgery, potentially leading to a firewall bypass and allowing unauthorized network access."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-823",
                "description": "Use of Out-of-range Pointer Offset",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T12:05:18.939Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46244"
          },
          {
            "name": "RHBZ#2484451",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484451"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46244.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33215"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34443"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34094"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55618"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56225"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55763"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:33215: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34443: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55618: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56225: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55763: Red Hat Enterprise Linux BaseOS (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-03T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-03T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_inner.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c161ad9157f5a0429b5ff94d9770faf3bf48d273",
              "status": "affected",
              "version": "3a07327d10a09379315c844c63f27941f5081e0a",
              "versionType": "git"
            },
            {
              "lessThan": "870d59e2cf218e7418491e26bad768cb16654582",
              "status": "affected",
              "version": "3a07327d10a09379315c844c63f27941f5081e0a",
              "versionType": "git"
            },
            {
              "lessThan": "689bbf48c1f45130086ae1c46ab83ea4c753c601",
              "status": "affected",
              "version": "3a07327d10a09379315c844c63f27941f5081e0a",
              "versionType": "git"
            },
            {
              "lessThan": "d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce",
              "status": "affected",
              "version": "3a07327d10a09379315c844c63f27941f5081e0a",
              "versionType": "git"
            },
            {
              "lessThan": "b6a91f68ebfed9c38e0e9150f58a9b85da07181c",
              "status": "affected",
              "version": "3a07327d10a09379315c844c63f27941f5081e0a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_inner.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_inner: Fix IPv6 inner_thoff desync\n\nIn nft_inner_parse_l2l3(), when processing inner IPv6 packets,\nipv6_find_hdr() correctly computes the transport header offset\ntraversing all extension headers, but the result is immediately\noverwritten with nhoff + sizeof(_ip6h) (40 bytes), which only\naccounts for the IPv6 base header. This creates a desync between\ninner_thoff (wrong \u2014 points to extension header start) and l4proto\n(correct \u2014 e.g., IPPROTO_TCP), enabling transport header forgery\nand potential firewall bypass. This issue affects stable versions\nfrom Linux 6.2.\n\nFor comparison, the normal (non-inner) IPv6 path correctly\npreserves ipv6_find_hdr()\u0027s result. Removing the incorrect overwrite\nensures that ipv6_find_hdr()\u0027s calculated transport header offset is\npreserved, thereby fixing the desynchronization."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Exploitation is triggered when a remote attacker sends crafted tunneled packets (GRE/Geneve/VXLAN/UDP/TCP) that are evaluated on netfilter ingress/forward hooks, not via netlink rule installation.\nAC:L - The attacker fully controls packet layout including inner IPv6 extension headers and can reliably desynchronize inner_thoff from the real transport header without races or rare layout conditions.\nPR:N - The attacker needs no privileges on the victim; only pre-existing nftables rules using the inner expression must be present, which is victim infrastructure rather than attacker privilege.\nUI:N - No victim user action is required beyond normal network traffic processing once vulnerable firewall rules exist.\nS:U - Impact is bypass of host netfilter policy within the kernel network security boundary, not VM escape, container breakout, or crossing a separate hardware/IOMMU authority.\nC:H - Bypassing inner-header filtering can expose confidential services and data on protected internal networks that the firewall was meant to block from the attacker\u2019s network position.\nI:H - The desync allows forged inner transport matches so traffic can be misclassified, defeating integrity of nftables filtering decisions and permitting unauthorized flows.\nA:N - The bug misdirects skb_copy_bits reads within attacker-supplied packet data and yields NFT_BREAK on failure; it does not corrupt kernel memory or cause panics/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:43.795Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273"
        },
        {
          "url": "https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582"
        },
        {
          "url": "https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c"
        }
      ],
      "title": "netfilter: nft_inner: Fix IPv6 inner_thoff desync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46244",
    "datePublished": "2026-06-03T15:48:59.049Z",
    "dateReserved": "2026-05-13T15:03:33.107Z",
    "dateUpdated": "2026-08-19T12:05:18.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46259 (GCVE-0-2026-46259)

Vulnerability from cvelistv5 – Published: 2026-06-03 15:49 – Updated: 2026-08-05 12:30

Title

procfs: fix missing RCU protection when reading real_parent in do_task_stat()

Summary

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/fefa0fcd78be465b7…
https://git.kernel.org/stable/c/c93a33f28f915d446…
https://git.kernel.org/stable/c/1c8dc5b5517546c68…
https://git.kernel.org/stable/c/0e64bd46a04a4fd61…
https://git.kernel.org/stable/c/73ec7c96601d61d52…
https://git.kernel.org/stable/c/4f9ae386861e280b7…
https://git.kernel.org/stable/c/dd8b13cb4ff1a4545…
https://git.kernel.org/stable/c/76149d53502cf17ef…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < fefa0fcd78be465b7ad4c497fa6ec90d64194c04 (git) Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < c93a33f28f915d446eea6fb3f0e1def0b3af1982 (git) Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < 1c8dc5b5517546c68ffae40b948336122bb61306 (git) Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e (git) Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < 73ec7c96601d61d52310c659145bb06d933a0fa6 (git) Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < 4f9ae386861e280b7631ca252f798d25575627ee (git) Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < dd8b13cb4ff1a4545a214ed897fdf2bc341155b6 (git) Affected: 06fffb1267c9d986687b69d74a46ee332a50575e , < 76149d53502cf17ef3ae454ff384551236fba867 (git)
Linux	Linux	Affected: 2.6.26 Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fefa0fcd78be465b7ad4c497fa6ec90d64194c04",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "c93a33f28f915d446eea6fb3f0e1def0b3af1982",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "1c8dc5b5517546c68ffae40b948336122bb61306",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "73ec7c96601d61d52310c659145bb06d933a0fa6",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "4f9ae386861e280b7631ca252f798d25575627ee",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "dd8b13cb4ff1a4545a214ed897fdf2bc341155b6",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "76149d53502cf17ef3ae454ff384551236fba867",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix missing RCU protection when reading real_parent in do_task_stat()\n\nWhen reading /proc/[pid]/stat, do_task_stat() accesses task-\u003ereal_parent\nwithout proper RCU protection, which leads to:\n\n  cpu 0                               cpu 1\n  -----                               -----\n  do_task_stat\n    var = task-\u003ereal_parent\n                                      release_task\n                                        call_rcu(delayed_put_task_struct)\n    task_tgid_nr_ns(var)\n      rcu_read_lock   \u003c--- Too late to protect task-\u003ereal_parent!\n      task_pid_ptr    \u003c--- UAF!\n      rcu_read_unlock\n\nThis patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add\nproper RCU protection for accessing task-\u003ereal_parent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local `open()`/`read()` on procfs (`/proc/[pid]/stat` or thread `stat`); there is no network, adjacent-radio, or physical-device path to `do_task_stat()`.\nAC:L - An attacker can reliably race by running concurrent `read()` loops on `/proc/child/stat` while another thread exits and reaps the parent via `wait4()`, controlling both sides of the `release_task()`/`call_rcu()` window.\nPR:L - Triggering the bug needs only an unprivileged local account that can read procfs (default `hidepid=off` allows reading other users\u2019 `stat`); no real root or init-namespace-only capability is required.\nUI:N - Exploitation is fully attacker-driven through syscalls and process lifecycle control; no victim user action (clicks, mounts, etc.) is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host.\nC:H - The UAF dereferences freed `task_struct` memory via `task_pid_ptr()`/`__task_pid_nr_ns()`, enabling disclosure of stale slab contents and kernel pointers that can be groomed into an arbitrary-read primitive.\nI:H - Use-after-free on a `task_struct` slab object can be leveraged with heap grooming for control of freed memory and potential arbitrary write or code execution, not merely a bounded or cosmetic change.\nA:H - Concurrent UAF access to a freed parent `task_struct` can cause kernel oops/panic (KASAN reports slab-use-after-free class failures) even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:48.120Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04"
        },
        {
          "url": "https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867"
        }
      ],
      "title": "procfs: fix missing RCU protection when reading real_parent in do_task_stat()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46259",
    "datePublished": "2026-06-03T15:49:56.428Z",
    "dateReserved": "2026-05-13T15:03:33.108Z",
    "dateUpdated": "2026-08-05T12:30:48.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46316 (GCVE-0-2026-46316)

Vulnerability from cvelistv5 – Published: 2026-06-09 11:52 – Updated: 2026-09-01 12:04

Title

KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributor's GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-911 - Improper Update of Reference Count

Assigner

Linux mitre root

References

15 references

URL	Tags
https://git.kernel.org/stable/c/b7b72e88046328c9f…
https://git.kernel.org/stable/c/2bbc395e81bd29c54…
https://git.kernel.org/stable/c/9121f4605ab94969f…
https://git.kernel.org/stable/c/13031fb6b8357fbbc…
https://access.redhat.com/security/cve/CVE-2026-46316	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486982	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:44231	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40787	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40779	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39371	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38902	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT

Impacted products

15 products

Vendor	Product	Version
Linux	Linux	Affected: 8201d1028caa4fae88e222c4e8cf541fdf45b821 , < b7b72e88046328c9fdc638fe887d4240257dd5dc (git) Affected: 8201d1028caa4fae88e222c4e8cf541fdf45b821 , < 2bbc395e81bd29c543a0529a678327e932a7ec69 (git) Affected: 8201d1028caa4fae88e222c4e8cf541fdf45b821 , < 9121f4605ab94969f62d1b5714ca3c6c69bd202f (git) Affected: 8201d1028caa4fae88e222c4e8cf541fdf45b821 , < 13031fb6b8357fbbcded2a7f4cba73e4781ee594 (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.30.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.88.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.127.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202607220857-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202607151937-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202607151836-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 4.22.9.8.202607152026-0 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux for NVIDIA 26	cpe:/a:redhat:enterprise_linux_nvidia:

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.30.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.88.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.127.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202607220857-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202607151937-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202607151836-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.22.9.8.202607152026-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux for NVIDIA 26",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-09T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) for ARM64, specifically within the vgic-its component. This vulnerability occurs when multiple concurrent operations incorrectly drop the translation cache\u0027s reference to an entry more than once during cache invalidation. This leads to a use-after-free condition, which can result in memory corruption. The primary impact is potential system instability or a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-911",
                "description": "Improper Update of Reference Count",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:04:58.704Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46316"
          },
          {
            "name": "RHBZ#2486982",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486982"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46316.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44231"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40787"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40779"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39371"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38902"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:44231: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40787: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40779: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40764: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39371: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38902: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-09T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-09T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7b72e88046328c9fdc638fe887d4240257dd5dc",
              "status": "affected",
              "version": "8201d1028caa4fae88e222c4e8cf541fdf45b821",
              "versionType": "git"
            },
            {
              "lessThan": "2bbc395e81bd29c543a0529a678327e932a7ec69",
              "status": "affected",
              "version": "8201d1028caa4fae88e222c4e8cf541fdf45b821",
              "versionType": "git"
            },
            {
              "lessThan": "9121f4605ab94969f62d1b5714ca3c6c69bd202f",
              "status": "affected",
              "version": "8201d1028caa4fae88e222c4e8cf541fdf45b821",
              "versionType": "git"
            },
            {
              "lessThan": "13031fb6b8357fbbcded2a7f4cba73e4781ee594",
              "status": "affected",
              "version": "8201d1028caa4fae88e222c4e8cf541fdf45b821",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry\n\nvgic_its_invalidate_cache() walks the per-ITS translation cache with\nxa_for_each() and drops the cache\u0027s reference on each entry with\nvgic_put_irq(). It puts the iterated pointer, though, rather than the\nvalue returned by xa_erase().\n\nThe function is called from contexts that do not exclude one another: the\nITS command handlers hold its_lock, the GITS_CTLR write path holds\ncmd_lock, and the path that clears EnableLPIs in a redistributor\u0027s\nGICR_CTLR holds neither. Two or more of them can drain the same cache\nconcurrently, and if each one observes the same entry, erases it and then\nputs it, the single reference the cache holds on that entry is dropped\nmore than once. The entry can then be freed while an ITE still maps it.\n\nxa_erase() is atomic and returns the previous entry, so put only the entry\nthat this context actually removed. The cache reference is then dropped\nexactly once per entry even when the invalidations run concurrently, and\nthe behavior is unchanged when only one context runs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 ITS registers (GITS_CTLR/CWRITER command processing) and redistributor GICR_CTLR LPI-disable writes, not from any network-facing host protocol.\nAC:L - A guest controls all racing contexts by pinning vCPUs to run concurrent ITS commands, GITS_CTLR disable, and GICR_CTLR LPI-disable on the same ITS translation cache; the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within the guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (`struct vgic_irq`) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - Premature `vgic_put_irq()` frees the LPI `vgic_irq` while an ITE still maps it, yielding a kernel heap use-after-free that can be leveraged for arbitrary host memory disclosure via subsequent IRQ structure dereferences.\nI:H - The dangling `vgic_irq` pointer allows attacker-influenced writes through IRQ state fields (`irq_lock`, `pending_latch`, `target_vcpu`, list heads), enabling heap grooming and potential host control-flow or data corruption.\nA:H - The refcount underflow frees live kernel objects still in use by the ITS, causing host kernel oops/panic or hang during subsequent LPI delivery, MSI injection, or ITS command handling."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:11.943Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7b72e88046328c9fdc638fe887d4240257dd5dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bbc395e81bd29c543a0529a678327e932a7ec69"
        },
        {
          "url": "https://git.kernel.org/stable/c/9121f4605ab94969f62d1b5714ca3c6c69bd202f"
        },
        {
          "url": "https://git.kernel.org/stable/c/13031fb6b8357fbbcded2a7f4cba73e4781ee594"
        }
      ],
      "title": "KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46316",
    "datePublished": "2026-06-09T11:52:29.349Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-09-01T12:04:58.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:36018

CVE-2025-10263 (GCVE-0-2025-10263)

CVE-2026-43112 (GCVE-0-2026-43112)

CVE-2026-43276 (GCVE-0-2026-43276)

CVE-2026-46116 (GCVE-0-2026-46116)

CVE-2026-46155 (GCVE-0-2026-46155)

CVE-2026-46209 (GCVE-0-2026-46209)

CVE-2026-46227 (GCVE-0-2026-46227)

CVE-2026-46244 (GCVE-0-2026-46244)

CVE-2026-46259 (GCVE-0-2026-46259)

CVE-2026-46316 (GCVE-0-2026-46316)

Tags

Sightings

Nomenclature