Vulnerability-Lookup

RHSA-2026:41234

Vulnerability from csaf_redhat - Published: 2026-07-17 12:52 - Updated: 2026-07-24 02:42

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Notes

Topic: An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-31684

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network (VLAN) headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of service.

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-43499

A flaw was found in the Linux kernel. When the kernel's real-time mutex (rtmutex) component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' (UAF) vulnerability, where the system attempts to use memory that has already been released. A local attacker could potentially exploit this to gain elevated privileges or execute unauthorized code.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-46116

A flaw was found in the Linux kernel's `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-53166

A flaw was found in the Linux kernel's futex (Fast Userspace Mutex) requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance (PI) futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the `remove_waiter()` function during a self-deadlock scenario, leads to a kernel crash, resulting in a Denial of Service (DoS).

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

28 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:41234	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461757	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480453	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492805	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-31684	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461757	external
https://www.cve.org/CVERecord?id=CVE-2026-31684	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31684	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-43499	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480453	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2026-43499	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43499	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46116	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	external
https://www.cve.org/CVERecord?id=CVE-2026-46116	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46116	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-53166	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492805	external
https://www.cve.org/CVERecord?id=CVE-2026-53166	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53166	external
https://lore.kernel.org/linux-cve-announce/202606…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)\n\n* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)\n\n* kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)\n\n* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:41234",
        "url": "https://access.redhat.com/errata/RHSA-2026:41234"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2461757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461757"
      },
      {
        "category": "external",
        "summary": "2480453",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480453"
      },
      {
        "category": "external",
        "summary": "2482523",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482523"
      },
      {
        "category": "external",
        "summary": "2492805",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492805"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41234.json"
      }
    ],
    "title": "Red Hat Security Advisory: kernel-rt security update",
    "tracking": {
      "current_release_date": "2026-07-24T02:42:21+00:00",
      "generator": {
        "date": "2026-07-24T02:42:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:41234",
      "initial_release_date": "2026-07-17T12:52:30+00:00",
      "revision_history": [
        {
          "date": "2026-07-17T12:52:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-17T12:52:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-24T02:42:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
                  "product_id": "7Server-RT-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras_rt_els:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
                "product": {
                  "name": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
                  "product_id": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@3.10.0-1160.156.1.rt56.1308.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-devel@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-devel@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace-devel@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                "product": {
                  "name": "kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_id": "kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace-debuginfo@3.10.0-1160.156.1.rt56.1308.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
                "product": {
                  "name": "kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
                  "product_id": "kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-doc@3.10.0-1160.156.1.rt56.1308.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src"
        },
        "product_reference": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch"
        },
        "product_reference": "kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        },
        "product_reference": "kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-31684",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461757"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network (VLAN) headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: net: sched: act_csum: validate nested VLAN headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
          "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31684"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461757",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461757"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31684",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31684"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31684",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31684"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026042545-CVE-2026-31684-6974@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026042545-CVE-2026-31684-6974@gregkh/T"
        }
      ],
      "release_date": "2026-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-17T12:52:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:41234"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: net: sched: act_csum: validate nested VLAN headers"
    },
    {
      "cve": "CVE-2026-43499",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480453"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel. When the kernel\u0027s real-time mutex (rtmutex) component performs a specific operation called \u0027proxy-lock rollback\u0027 during futex requeue, it incorrectly handles task pointers. This can lead to a \u0027Use-After-Free\u0027 (UAF) vulnerability, where the system attempts to use memory that has already been released. A local attacker could potentially exploit this to gain elevated privileges or execute unauthorized code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: rtmutex: Use waiter::task instead of current in remove_waiter()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
          "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43499"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480453",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480453"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-010",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43499",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43499",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43499"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026052158-CVE-2026-43499-1294@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026052158-CVE-2026-43499-1294@gregkh/T"
        }
      ],
      "release_date": "2026-05-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-17T12:52:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:41234"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: rtmutex: Use waiter::task instead of current in remove_waiter()"
    },
    {
      "cve": "CVE-2026-46116",
      "cwe": {
        "id": "CWE-763",
        "name": "Release of Invalid Pointer or Reference"
      },
      "discovery_date": "2026-05-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2482523"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
          "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46116"
        },
        {
          "category": "external",
          "summary": "RHBZ#2482523",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482523"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46116",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46116",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46116"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026052814-CVE-2026-46116-73b8@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026052814-CVE-2026-46116-73b8@gregkh/T"
        }
      ],
      "release_date": "2026-05-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-17T12:52:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:41234"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete"
    },
    {
      "cve": "CVE-2026-53166",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-06-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492805"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s futex (Fast Userspace Mutex) requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance (PI) futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the `remove_waiter()` function during a self-deadlock scenario, leads to a kernel crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
          "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53166"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492805",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492805"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-010",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53166",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53166"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53166",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53166"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026062551-CVE-2026-53166-2861@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026062551-CVE-2026-53166-2861@gregkh/T"
        }
      ],
      "release_date": "2026-06-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-17T12:52:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:41234"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.156.1.rt56.1308.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.156.1.rt56.1308.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock"
    }
  ]
}

CVE-2026-31684 (GCVE-0-2026-31684)

Vulnerability from cvelistv5 – Published: 2026-04-25 08:47 – Updated: 2026-06-01 16:13

Title

net: sched: act_csum: validate nested VLAN headers

Summary

In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants. Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/0410c619e86551677…
https://git.kernel.org/stable/c/886469b6455611a51…
https://git.kernel.org/stable/c/46c07ad50fa2f4ba7…
https://git.kernel.org/stable/c/eb3765b90eb8f2a3d…
https://git.kernel.org/stable/c/a69738efea0996d05…
https://git.kernel.org/stable/c/ec4930979b3f7bbeb…
https://git.kernel.org/stable/c/3d165d975305cf76f…
https://git.kernel.org/stable/c/c842743d073bdd683…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < 0410c619e86551677fb79887a38eccad3f5a0725 (git) Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < 886469b6455611a511aa6013e957e15e50577513 (git) Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < 46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09 (git) Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2 (git) Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < a69738efea0996d05a3c7d2178551b891744df1b (git) Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < ec4930979b3f7bbeb7af5744599fc6603a4dba62 (git) Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < 3d165d975305cf76ff0b10a3c798fb31e5f5f9a5 (git) Affected: 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 , < c842743d073bdd683606cb414eb0ca84465dd834 (git) Affected: 3764bfae5056e95617b6ee074129297e11710886 (git) Affected: 4.19.99 , < 4.20 (semver)
Linux	Linux	Affected: 5.1 Unaffected: 0 , < 5.1 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_csum.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0410c619e86551677fb79887a38eccad3f5a0725",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "lessThan": "886469b6455611a511aa6013e957e15e50577513",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "lessThan": "46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "lessThan": "eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "lessThan": "a69738efea0996d05a3c7d2178551b891744df1b",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "lessThan": "ec4930979b3f7bbeb7af5744599fc6603a4dba62",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "lessThan": "3d165d975305cf76ff0b10a3c798fb31e5f5f9a5",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "lessThan": "c842743d073bdd683606cb414eb0ca84465dd834",
              "status": "affected",
              "version": "2ecba2d1e45b24620a7c3df9531895cf68d5dec6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3764bfae5056e95617b6ee074129297e11710886",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.99",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_csum.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.99",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_csum: validate nested VLAN headers\n\ntcf_csum_act() walks nested VLAN headers directly from skb-\u003edata when an\nskb still carries in-payload VLAN tags. The current code reads\nvlan-\u003eh_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without\nfirst ensuring that the full VLAN header is present in the linear area.\n\nIf only part of an inner VLAN header is linearized, accessing\nh_vlan_encapsulated_proto reads past the linear area, and the following\nskb_pull(VLAN_HLEN) may violate skb invariants.\n\nFix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and\npulling each nested VLAN header. If the header still is not fully\navailable, drop the packet through the existing error path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:13:24.352Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725"
        },
        {
          "url": "https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513"
        },
        {
          "url": "https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834"
        }
      ],
      "title": "net: sched: act_csum: validate nested VLAN headers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31684",
    "datePublished": "2026-04-25T08:47:01.555Z",
    "dateReserved": "2026-03-09T15:48:24.130Z",
    "dateUpdated": "2026-06-01T16:13:24.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43499 (GCVE-0-2026-43499)

Vulnerability from cvelistv5 – Published: 2026-05-21 12:17 – Updated: 2026-07-24 14:33

Title

rtmutex: Use waiter::task instead of current in remove_waiter()

Summary

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

9 references

URL	Tags
https://git.kernel.org/stable/c/f3fa3424bceb128d2…
https://git.kernel.org/stable/c/838ce5cb5d93c3ab8…
https://git.kernel.org/stable/c/d8cce4773c2b23d81…
https://git.kernel.org/stable/c/8a1fc8d698ac5e591…
https://git.kernel.org/stable/c/6d52dfcb2a5db86e3…
https://git.kernel.org/stable/c/3fb7394a837740770…
https://git.kernel.org/stable/c/88614876370aac8ad…
https://git.kernel.org/stable/c/3bfdc63936dd47731…
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < f3fa3424bceb128d2be4b3745506b22844b87db7 (git) Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd (git) Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < d8cce4773c2b23d819baf5abedc62f7b430e8745 (git) Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < 8a1fc8d698ac5e5916e3082a0f74450d71f9611f (git) Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 (git) Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < 3fb7394a837740770f0d6b4b30567e60786a63f2 (git) Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < 88614876370aac8ad1050ad785a4c095ba17ac11 (git) Affected: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 , < 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 (git)
Linux	Linux	Affected: 2.6.39 Unaffected: 0 , < 2.6.39 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-08T22:22:10.721Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/08/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/locking/rtmutex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3fa3424bceb128d2be4b3745506b22844b87db7",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            },
            {
              "lessThan": "838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            },
            {
              "lessThan": "d8cce4773c2b23d819baf5abedc62f7b430e8745",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            },
            {
              "lessThan": "8a1fc8d698ac5e5916e3082a0f74450d71f9611f",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            },
            {
              "lessThan": "6d52dfcb2a5db86e346cf51f8fcf2071b8085166",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            },
            {
              "lessThan": "3fb7394a837740770f0d6b4b30567e60786a63f2",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            },
            {
              "lessThan": "88614876370aac8ad1050ad785a4c095ba17ac11",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            },
            {
              "lessThan": "3bfdc63936dd4773109b7b8c280c0f3b5ae7d349",
              "status": "affected",
              "version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/locking/rtmutex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n  2) the waiter task\u0027s pi_blocked_on state is not cleared, which leaves a\n     dangling pointer primed for UAF around.\n\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n     task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n  \tchangelog ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:37.807Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7"
        },
        {
          "url": "https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349"
        }
      ],
      "title": "rtmutex: Use waiter::task instead of current in remove_waiter()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43499",
    "datePublished": "2026-05-21T12:17:49.281Z",
    "dateReserved": "2026-05-01T14:12:56.014Z",
    "dateUpdated": "2026-07-24T14:33:37.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46116 (GCVE-0-2026-46116)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-07-24 14:33

Title

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

Summary

In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being: BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline] BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435 Workqueue: netns cleanup_net Call Trace: __hlist_del / hlist_del_rcu __xfrm_state_delete xfrm_state_delete xfrm_state_flush xfrm_state_fini ops_exit_list cleanup_net The other observed signatures hit the same slab object from __xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB write variant of __xfrm_state_delete, all on the byseq/byspi hash chains. __xfrm_state_delete() guards its byseq and byspi unhashes with value-based predicates: if (x->km.seq) hlist_del_rcu(&x->byseq); if (x->id.spi) hlist_del_rcu(&x->byspi); while everywhere else in the file (e.g. state_cache, state_cache_input) the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets x->id.spi = newspi inside xfrm_state_lock and then immediately inserts into byspi, but a path that observes x->id.spi != 0 outside of xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently with whether x is actually on the list. The same holds for x->km.seq versus byseq, and the bydst/bysrc unhashes have no predicate at all, so a second __xfrm_state_delete() on the same object writes through LIST_POISON pprev. The defensive change here: - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst, bysrc, byseq and byspi so a second deletion is a no-op rather than a write through LIST_POISON pprev. The byseq/byspi nodes are already initialised in xfrm_state_alloc(). - Test hlist_unhashed() rather than the value predicate for byseq/byspi, so the unhash decision tracks list state rather than mutable scalar fields. Empirical verification: applied this patch on top of v6.12.47, rebuilt, and re-ran the same syzkaller harness for 1h16m on a previously-crashy configuration that produced ~100 hits each of slab-use-after-free Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in __xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at ~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo confirms the xfrm_state slab is actively allocated and freed during the run (~143 KiB resident), so the fuzzer is still exercising those code paths -- they just no longer crash. Reproduction: - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal - 9 unique signatures collected in ~9h, all within xfrm_state lifecycle

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-763 - Release of Invalid Pointer or Reference

Assigner

Linux

References

20 references

URL	Tags
https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5…
https://git.kernel.org/stable/c/3943fcad7694a7d0b…
https://git.kernel.org/stable/c/2c617848ae6e4f07a…
https://git.kernel.org/stable/c/b4a53add2fa8f1b5a…
https://git.kernel.org/stable/c/26edb0a3c99f9d958…
https://git.kernel.org/stable/c/4980162de555cb838…
https://git.kernel.org/stable/c/a2e2d08fb070fab49…
https://git.kernel.org/stable/c/14acf9652e5690de3…
https://access.redhat.com/security/cve/CVE-2026-46116	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41235	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41234	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39371	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42919	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43231	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44385	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39179	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39180	vendor-advisoryx_refsource_REDHAT

Impacted products

13 products

Vendor	Product	Version
Linux	Linux	Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 2c617848ae6e4f07a3e397f604208c293bbecacc (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < b4a53add2fa8f1b5aa17d4c5686c320785fab182 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 26edb0a3c99f9d958c212be68b21f1221614dcf0 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 4980162de555cb838f1a189ce7d2cbf5d2e7b050 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < a2e2d08fb070fab4947447171f1c4e3ca5a188e5 (git) Affected: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 , < 14acf9652e5690de3c7486c6db5fb8dafd0a32a3 (git)
Linux	Linux	Affected: 2.6.19 Unaffected: 0 , < 2.6.19 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.37.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.88.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.156.1.rt56.1308.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.156.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.144.1.rt7.485.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.144.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.139.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.129.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.37.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.88.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.156.1.rt56.1308.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.156.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.144.1.rt7.485.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.144.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.139.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.129.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-28T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-763",
                "description": "Release of Invalid Pointer or Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T12:05:32.884Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46116"
          },
          {
            "name": "RHBZ#2482523",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482523"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41235"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41234"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39371"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42919"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43231"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44385"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39179"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39180"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41235: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41234: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39371: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43231: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44385: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39179: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39180: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "2c617848ae6e4f07a3e397f604208c293bbecacc",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "b4a53add2fa8f1b5aa17d4c5686c320785fab182",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "26edb0a3c99f9d958c212be68b21f1221614dcf0",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "4980162de555cb838f1a189ce7d2cbf5d2e7b050",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "a2e2d08fb070fab4947447171f1c4e3ca5a188e5",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            },
            {
              "lessThan": "14acf9652e5690de3c7486c6db5fb8dafd0a32a3",
              "status": "affected",
              "version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()\u0027s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n  BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n  BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n  BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n  Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n  Workqueue: netns cleanup_net\n  Call Trace:\n   __hlist_del / hlist_del_rcu\n   __xfrm_state_delete\n   xfrm_state_delete\n   xfrm_state_flush\n   xfrm_state_fini\n   ops_exit_list\n   cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x-\u003ekm.seq)\n\t\thlist_del_rcu(\u0026x-\u003ebyseq);\n\tif (x-\u003eid.spi)\n\t\thlist_del_rcu(\u0026x-\u003ebyspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx-\u003eid.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x-\u003eid.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x-\u003ekm.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n  - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n    bysrc, byseq and byspi so a second deletion is a no-op rather\n    than a write through LIST_POISON pprev. The byseq/byspi nodes\n    are already initialised in xfrm_state_alloc().\n  - Test hlist_unhashed() rather than the value predicate for\n    byseq/byspi, so the unhash decision tracks list state rather than\n    mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n  - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n  - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n  - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n  - 9 unique signatures collected in ~9h, all within xfrm_state\n    lifecycle"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:40.270Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182"
        },
        {
          "url": "https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3"
        }
      ],
      "title": "xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46116",
    "datePublished": "2026-05-28T09:35:30.689Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-07-24T14:33:40.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53166 (GCVE-0-2026-53166)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-07-10 11:57

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-07-10T11:57:35.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53166",
    "datePublished": "2026-06-25T08:38:46.089Z",
    "dateRejected": "2026-07-10T11:57:35.720Z",
    "dateReserved": "2026-06-09T07:44:35.389Z",
    "dateUpdated": "2026-07-10T11:57:35.720Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHSA-2026:41234

CVE-2026-31684 (GCVE-0-2026-31684)

CVE-2026-43499 (GCVE-0-2026-43499)

CVE-2026-46116 (GCVE-0-2026-46116)

CVE-2026-53166 (GCVE-0-2026-53166)

Tags

Sightings

Nomenclature