Vulnerability-Lookup

RHSA-2026:55445

Vulnerability from csaf_redhat - Published: 2026-08-17 05:05 - Updated: 2026-09-10 22:01

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089) * kernel: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (CVE-2025-71131) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) Bug Fix(es) and Enhancement(s): * backport make module and modules-core provides use variant [rhel-10.0.z] (JIRA:RHEL-219433) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-10263

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise.

8.4 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 307 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debug-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debug-devel-matched-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-devel-matched-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-ppc64le-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-s390x-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-doc-0:6.12.0-55.98.1.el10_0.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-zfcpdump-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-zfcpdump-devel-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-zfcpdump-devel-matched-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.98.1.el10_0.src	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-abi-stablelists-0:6.12.0-55.98.1.el10_0.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-uki-virt-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-ppc64le-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-s390x-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-libs-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-libs-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-libs-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-addons-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-addons-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-core-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-modules-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-modules-core-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-modules-extra-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-ppc64le-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-s390x-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-libs-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-libs-devel-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-libs-devel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-zfcpdump-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-devel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-kvm-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-modules-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-modules-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-modules-extra-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-devel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-kvm-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-modules-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-modules-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-modules-extra-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-devel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-extra-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-devel-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-devel-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-core-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-core-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-extra-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-extra-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.98.1.el10_0.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2025-71089

A security vulnerability was found in the Linux kernel's IOMMU Shared Virtual Addressing (SVA) implementation on x86 architecture. When SVA is enabled, the IOMMU caches kernel page table entries. Since the kernel lacks a mechanism to notify the IOMMU when kernel page table pages are freed and reallocated, the IOMMU can retain stale entries pointing to reused memory. This can lead to use-after-free or write-after-free conditions, potentially enabling arbitrary physical memory DMA access or privilege escalation.

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-820 - Missing Synchronization

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2025-71131

A use-after-free vulnerability was found in the Linux kernel's seqiv (Sequence IV) crypto module. After calling crypto_aead_encrypt(), the underlying request may be freed by asynchronous completion handlers. The code then incorrectly dereferences req->iv to compare against info, accessing potentially freed memory. This can cause memory corruption or crashes when using asynchronous AEAD encryption.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-23110

Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsi_dec_host_busy() and ordering problems in scsi_eh_inc_host_failed() can cause the SCSI error handler to never wake up when command completions race against each other. This leaves I/O stuck indefinitely as the error recovery state cannot advance.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-821 - Incorrect Synchronization

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Low

CVE-2026-23375

A flaw was found in the Linux kernel's Transparent Huge Pages (THP) mechanism. This vulnerability occurs because the `file_thp_enabled()` function incorrectly allows THP for files on anonymous inodes, which are not designed for this feature. An attacker could potentially exploit this by manipulating specific memory operations, leading to a kernel crash when handling secret memory pages. Additionally, it can cause incorrect memory failure reports for guest memory files.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-23455

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the `nf_conntrack_h323` module. This vulnerability occurs in the `DecodeQ931()` function when processing a zero-length value from a packet. An integer underflow during a length calculation results in a large, incorrect value being passed to a subsequent function, leading to an out-of-bounds read. This could allow an attacker to cause a denial of service or potentially disclose sensitive information.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-31488

A flaw was found in the Linux kernel's AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression (DSC) processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a memory leak and a use-after-free error. This could result in system crashes, denial of service, or potentially allow the attacker to gain elevated privileges.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1288 - Improper Validation of Consistency within Input

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-43279

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a local user.

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-45998

A flaw was found in the Linux kernel's `rxrpc` subsystem. This vulnerability arises when the system attempts to unshare a packet buffer, and the operation fails due to an allocation issue. This failure can lead to a Use-After-Free (UAF) condition, where the system attempts to access memory that has been freed, potentially causing a system crash.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-53000

A flaw was found in the Linux kernel's netfilter component, specifically within the Network Address Translation (NAT) subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system crash, leading to a Denial of Service (DoS), or to gain unauthorized access to sensitive information due to the partial exposure of internal hook data during error handling.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Important

CVE-2026-53059

A flaw was found in the Linux kernel's device-mapper log (dm log) component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log operations. Successful exploitation of this flaw can cause a kernel crash, resulting in a Denial of Service (DoS) for the affected system.

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Moderate

CVE-2026-53264

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been released. This could potentially allow an attacker to cause system instability or execute arbitrary code.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-364 - Signal Handler Race Condition

Affected products

Fixed 307 products, the same list as for CVE-2025-10263

Threats

Impact Important

References

75 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:55445	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2429104	external
https://bugzilla.redhat.com/show_bug.cgi?id=2429583	external
https://bugzilla.redhat.com/show_bug.cgi?id=2436755	external
https://bugzilla.redhat.com/show_bug.cgi?id=2451199	external
https://bugzilla.redhat.com/show_bug.cgi?id=2454810	external
https://bugzilla.redhat.com/show_bug.cgi?id=2460619	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467215	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482024	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486958	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492273	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492277	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492851	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-10263	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486958	external
https://www.cve.org/CVERecord?id=CVE-2025-10263	external
https://nvd.nist.gov/vuln/detail/CVE-2025-10263	external
https://developer.arm.com/documentation/112137	external
https://access.redhat.com/security/cve/CVE-2025-71089	self
https://bugzilla.redhat.com/show_bug.cgi?id=2429104	external
https://www.cve.org/CVERecord?id=CVE-2025-71089	external
https://nvd.nist.gov/vuln/detail/CVE-2025-71089	external
https://lore.kernel.org/linux-cve-announce/202601…	external
https://access.redhat.com/security/cve/CVE-2025-71131	self
https://bugzilla.redhat.com/show_bug.cgi?id=2429583	external
https://www.cve.org/CVERecord?id=CVE-2025-71131	external
https://nvd.nist.gov/vuln/detail/CVE-2025-71131	external
https://lore.kernel.org/linux-cve-announce/202601…	external
https://access.redhat.com/security/cve/CVE-2026-23110	self
https://bugzilla.redhat.com/show_bug.cgi?id=2436755	external
https://www.cve.org/CVERecord?id=CVE-2026-23110	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23110	external
https://lore.kernel.org/linux-cve-announce/202602…	external
https://access.redhat.com/security/cve/CVE-2026-23375	self
https://bugzilla.redhat.com/show_bug.cgi?id=2451199	external
https://www.cve.org/CVERecord?id=CVE-2026-23375	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23375	external
https://lore.kernel.org/linux-cve-announce/202603…	external
https://access.redhat.com/security/cve/CVE-2026-23455	self
https://bugzilla.redhat.com/show_bug.cgi?id=2454810	external
https://www.cve.org/CVERecord?id=CVE-2026-23455	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23455	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31488	self
https://bugzilla.redhat.com/show_bug.cgi?id=2460619	external
https://www.cve.org/CVERecord?id=CVE-2026-31488	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31488	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-43279	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467215	external
https://www.cve.org/CVERecord?id=CVE-2026-43279	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43279	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-45998	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482024	external
https://www.cve.org/CVERecord?id=CVE-2026-45998	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45998	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-53000	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492273	external
https://www.cve.org/CVERecord?id=CVE-2026-53000	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53000	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53059	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492277	external
https://www.cve.org/CVERecord?id=CVE-2026-53059	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53059	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53264	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492851	external
https://www.cve.org/CVERecord?id=CVE-2026-53264	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53264	external
https://lore.kernel.org/linux-cve-announce/202606…	external

JSON

To clipboard

Loading 1.2 MB of JSON…

CVE-2025-10263 (GCVE-0-2025-10263)

Vulnerability from cvelistv5 – Published: 2026-06-09 09:23 – Updated: 2026-09-04 12:04

Summary

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 14:11 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-266 - Incorrect Privilege Assignment

Assigner

Arm mitre root

References

29 references

URL	Tags
https://developer.arm.com/documentation/112137
http://xenbits.xen.org/xsa/advisory-493.html
http://www.openwall.com/lists/oss-security/2026/0…
https://access.redhat.com/security/cve/CVE-2025-10263	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2486958	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:54205	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54187	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56786	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56853	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54544	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54553	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54581	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54599	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55445	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51603	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51746	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49031	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36349	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47248	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49033	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36348	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51604	vendor-advisoryx_refsource_REDHAT

Impacted products

52 products

Vendor	Product	Version
Arm	C1-Ultra	Affected: 0
Arm	C1-Premium	Affected: 0
Arm	Neoverse V3	Affected: 0
Arm	Neoverse V3AE	Affected: 0
Arm	Neoverse V1	Affected: 0
Arm	Neoverse N2	Affected: 0
Arm	Neoverse N1	Affected: 0
Arm	Cortex-X925	Affected: 0
Arm	Cortex-X4	Affected: 0
Arm	Cortex-X3	Affected: 0
Arm	Cortex-X2	Affected: 0
Arm	Cortex-X1	Affected: 0
Arm	Cortex-X1C	Affected: 0
Arm	Cortex-A710	Affected: 0
Arm	Cortex-A78	Affected: 0
Arm	Cortex-A78AE	Affected: 0
Arm	Cortex-A78C	Affected: 0
Arm	Cortex-A77	Affected: 0
Arm	Cortex-A76	Affected: 0
Arm	Cortex-A76AE	Affected: 0
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.30.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.98.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.rt7.481.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.200.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.200.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.204.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.204.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.186.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.186.1.rt14.471.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.143.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.131.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202608080425-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202608111330-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202608172040-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202608180329-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202608150307-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202608250221-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202608111829-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202608120446-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202608121719-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202608122143-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 4.22.9.8.202607152026-0 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux for NVIDIA 26	cpe:/a:redhat:enterprise_linux_nvidia:
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-09T16:53:49.813Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-493.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/09/13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-10263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T14:11:21.775441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T14:11:48.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.30.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.98.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.rt7.481.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.200.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.200.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.204.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.204.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.186.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.186.1.rt14.471.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.143.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.131.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202608080425-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202608111330-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202608172040-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202608180329-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202608150307-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202608250221-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202608111829-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202608120446-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202608121719-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202608122143-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.22.9.8.202607152026-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux for NVIDIA 26",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-09T09:23:18.802Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-266",
                "description": "Incorrect Privilege Assignment",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T12:04:56.776Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2025-10263"
          },
          {
            "name": "RHBZ#2486958",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486958"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10263.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54205"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54187"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56786"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56853"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54544"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54553"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54581"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54599"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55445"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51603"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51746"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49031"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36349"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47248"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49033"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36348"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51604"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:54205: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54187: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56786: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56911: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56853: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60019: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54544: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54553: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54581: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54599: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40764: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51603: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51746: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49031: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36349: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47248: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49033: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36348: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51604: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-09T11:01:37.157Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-09T09:23:18.802Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C1-Ultra",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "C1-Premium",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse V3",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse V3AE",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse V1",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse N2",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Neoverse N1",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X925",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X4",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X3",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X2",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X1",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-X1C",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A710",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A78",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A78AE",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A78C",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A77",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A76",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cortex-A76AE",
          "vendor": "Arm",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026amp; V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026amp; X1C, Cortex-A710, Cortex-A78, A78AE \u0026amp; A78C, Cortex-A77, Cortex-A76 \u0026amp; A76A may allow writes to resources owned by a higher exception level."
            }
          ],
          "value": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026 V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026 X1C, Cortex-A710, Cortex-A78, A78AE \u0026 A78C, Cortex-A77, Cortex-A76 \u0026 A76A may allow writes to resources owned by a higher exception level."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T09:23:18.802Z",
        "orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
        "shortName": "Arm"
      },
      "references": [
        {
          "url": "https://developer.arm.com/documentation/112137"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
    "assignerShortName": "Arm",
    "cveId": "CVE-2025-10263",
    "datePublished": "2026-06-09T09:23:18.802Z",
    "dateReserved": "2025-09-11T08:50:36.018Z",
    "dateUpdated": "2026-09-04T12:04:56.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71089 (GCVE-0-2025-71089)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:34 – Updated: 2026-08-05 12:11

Title

iommu: disable SVA when CONFIG_X86 is set

Summary

In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel page table entries. When a kernel page table page is freed and reallocated for another purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-free or write-after-free condition, potentially leading to privilege escalation or data corruption. This solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window to notify the IOMMU to invalidate its caches before the page is reused. This patch (of 8): In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The x86 architecture maps the kernel's virtual address space into the upper portion of every process's page table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries. The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA. Use-After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables. Currently, SVA contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and errors out. This means the IOMMU still caches these intermediate page table entries, making the described vulnerability a real concern. Disable SVA on x86 architecture until the IOMMU can receive notification to flush the paging cache before freeing the CPU kernel page table pages.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 16:19 UTC

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/b34289505180a8360…
https://git.kernel.org/stable/c/7cad37e358970af1b…
https://git.kernel.org/stable/c/240cd7f2812cc2549…
https://git.kernel.org/stable/c/c2c3f1a3fd74ef16c…
https://git.kernel.org/stable/c/c341dee80b5df49a9…
https://git.kernel.org/stable/c/72f98ef9a4be30d2a…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 , < b34289505180a83607fcfdce14b5a290d0528476 (git) Affected: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 , < 7cad37e358970af1bb49030ff01f06a69fa7d985 (git) Affected: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 , < 240cd7f2812cc25496b12063d11c823618f364e9 (git) Affected: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 , < c2c3f1a3fd74ef16cf115f0c558616a13a8471b4 (git) Affected: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 , < c341dee80b5df49a936182341b36395c831c2661 (git) Affected: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 , < 72f98ef9a4be30d2a60136dd6faee376f780d06c (git)
Linux	Linux	Affected: 5.2 Unaffected: 0 , < 5.2 (semver) Unaffected: 5.15.200 , ≤ 5.15.* (semver) Unaffected: 6.1.163 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.64 , ≤ 6.12.* (semver) Unaffected: 6.18.4 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T16:19:59.752068Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T16:20:14.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b34289505180a83607fcfdce14b5a290d0528476",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "7cad37e358970af1bb49030ff01f06a69fa7d985",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "240cd7f2812cc25496b12063d11c823618f364e9",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "c2c3f1a3fd74ef16cf115f0c558616a13a8471b4",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "c341dee80b5df49a936182341b36395c831c2661",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "72f98ef9a4be30d2a60136dd6faee376f780d06c",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.200",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: disable SVA when CONFIG_X86 is set\n\nPatch series \"Fix stale IOTLB entries for kernel address space\", v7.\n\nThis proposes a fix for a security vulnerability related to IOMMU Shared\nVirtual Addressing (SVA).  In an SVA context, an IOMMU can cache kernel\npage table entries.  When a kernel page table page is freed and\nreallocated for another purpose, the IOMMU might still hold stale,\nincorrect entries.  This can be exploited to cause a use-after-free or\nwrite-after-free condition, potentially leading to privilege escalation or\ndata corruption.\n\nThis solution introduces a deferred freeing mechanism for kernel page\ntable pages, which provides a safe window to notify the IOMMU to\ninvalidate its caches before the page is reused.\n\n\nThis patch (of 8):\n\nIn the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware\nshares and walks the CPU\u0027s page tables.  The x86 architecture maps the\nkernel\u0027s virtual address space into the upper portion of every process\u0027s\npage table.  Consequently, in an SVA context, the IOMMU hardware can walk\nand cache kernel page table entries.\n\nThe Linux kernel currently lacks a notification mechanism for kernel page\ntable changes, specifically when page table pages are freed and reused. \nThe IOMMU driver is only notified of changes to user virtual address\nmappings.  This can cause the IOMMU\u0027s internal caches to retain stale\nentries for kernel VA.\n\nUse-After-Free (UAF) and Write-After-Free (WAF) conditions arise when\nkernel page table pages are freed and later reallocated.  The IOMMU could\nmisinterpret the new data as valid page table entries.  The IOMMU might\nthen walk into attacker-controlled memory, leading to arbitrary physical\nmemory DMA access or privilege escalation.  This is also a\nWrite-After-Free issue, as the IOMMU will potentially continue to write\nAccessed and Dirty bits to the freed memory while attempting to walk the\nstale page tables.\n\nCurrently, SVA contexts are unprivileged and cannot access kernel\nmappings.  However, the IOMMU will still walk kernel-only page tables all\nthe way down to the leaf entries, where it realizes the mapping is for the\nkernel and errors out.  This means the IOMMU still caches these\nintermediate page table entries, making the described vulnerability a real\nconcern.\n\nDisable SVA on x86 architecture until the IOMMU can receive notification\nto flush the paging cache before freeing the CPU kernel page table pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "IOMMU SVA stale kernel page table entries enable arbitrary physical memory DMA access. IOMMU caches kernel page table entries that become stale when freed and reallocated, allowing walk into attacker-controlled memory. Scope Changed as it breaks IOMMU hardware isolation boundary."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:58.679Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b34289505180a83607fcfdce14b5a290d0528476"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cad37e358970af1bb49030ff01f06a69fa7d985"
        },
        {
          "url": "https://git.kernel.org/stable/c/240cd7f2812cc25496b12063d11c823618f364e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2c3f1a3fd74ef16cf115f0c558616a13a8471b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c341dee80b5df49a936182341b36395c831c2661"
        },
        {
          "url": "https://git.kernel.org/stable/c/72f98ef9a4be30d2a60136dd6faee376f780d06c"
        }
      ],
      "title": "iommu: disable SVA when CONFIG_X86 is set",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71089",
    "datePublished": "2026-01-13T15:34:51.079Z",
    "dateReserved": "2026-01-13T15:30:19.649Z",
    "dateUpdated": "2026-08-05T12:11:58.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71131 (GCVE-0-2025-71131)

Vulnerability from cvelistv5 – Published: 2026-01-14 15:07 – Updated: 2026-09-08 08:44

Title

crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid. Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/18202537856e0fae0…
https://git.kernel.org/stable/c/baf0e2d1e03ddb047…
https://git.kernel.org/stable/c/50f196d2bbaee4ab2…
https://git.kernel.org/stable/c/0279978adec6f1296…
https://git.kernel.org/stable/c/ccbb96434d88e3235…
https://git.kernel.org/stable/c/5476f7f8a31123660…
https://git.kernel.org/stable/c/50fdb78b7c0bcc550…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 0a270321dbf948963aeb0e8382fe17d2c2eb3771 , < 18202537856e0fae079fed2c9308780bcff2bb9d (git) Affected: 0a270321dbf948963aeb0e8382fe17d2c2eb3771 , < baf0e2d1e03ddb04781dfe7f22a654d3611f69b2 (git) Affected: 0a270321dbf948963aeb0e8382fe17d2c2eb3771 , < 50f196d2bbaee4ab2494bb1b0d294deba292951a (git) Affected: 0a270321dbf948963aeb0e8382fe17d2c2eb3771 , < 0279978adec6f1296af66b642cce641c6580be46 (git) Affected: 0a270321dbf948963aeb0e8382fe17d2c2eb3771 , < ccbb96434d88e32358894c879457b33f7508e798 (git) Affected: 0a270321dbf948963aeb0e8382fe17d2c2eb3771 , < 5476f7f8a311236604b78fcc5b2a63b3a61b0169 (git) Affected: 0a270321dbf948963aeb0e8382fe17d2c2eb3771 , < 50fdb78b7c0bcc550910ef69c0984e751cac72fa (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 6.1.160 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.64 , ≤ 6.12.* (semver) Unaffected: 6.18.4 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71131",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:45.516602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:04.983Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:44:01.897Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/seqiv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "18202537856e0fae079fed2c9308780bcff2bb9d",
              "status": "affected",
              "version": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
              "versionType": "git"
            },
            {
              "lessThan": "baf0e2d1e03ddb04781dfe7f22a654d3611f69b2",
              "status": "affected",
              "version": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
              "versionType": "git"
            },
            {
              "lessThan": "50f196d2bbaee4ab2494bb1b0d294deba292951a",
              "status": "affected",
              "version": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
              "versionType": "git"
            },
            {
              "lessThan": "0279978adec6f1296af66b642cce641c6580be46",
              "status": "affected",
              "version": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
              "versionType": "git"
            },
            {
              "lessThan": "ccbb96434d88e32358894c879457b33f7508e798",
              "status": "affected",
              "version": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
              "versionType": "git"
            },
            {
              "lessThan": "5476f7f8a311236604b78fcc5b2a63b3a61b0169",
              "status": "affected",
              "version": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
              "versionType": "git"
            },
            {
              "lessThan": "50fdb78b7c0bcc550910ef69c0984e751cac72fa",
              "status": "affected",
              "version": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/seqiv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Do not use req-\u003eiv after crypto_aead_encrypt\n\nAs soon as crypto_aead_encrypt is called, the underlying request\nmay be freed by an asynchronous completion.  Thus dereferencing\nreq-\u003eiv after it returns is invalid.\n\nInstead of checking req-\u003eiv against info, create a new variable\nunaligned_info and use it for that purpose instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote peer can trigger outbound ESP encryption by sending TCP traffic that induces protected ACKs or replies through an existing XFRM policy.\nAC:L - With an asynchronous accelerator present, repeated traffic creates the submission/completion race without requiring precise heap layout or victim action.\nPR:N - In an already-configured IPsec gateway or service deployment, the attacker only needs to send traffic that elicits protected output and does not need local capabilities.\nUI:N - No victim user action is required because packet processing and asynchronous completion occur automatically.\nS:U - The vulnerable crypto operation and resulting kernel impact remain within the host kernel\u0027s security authority.\nC:N - The freed req-\u003eiv value is only loaded for a pointer comparison and is never exposed. For asynchronous return values, the cleanup helper returns before any further dereference.\nI:N - The stale value cannot drive a store, arbitrary free, or control-flow target, so the vulnerable path provides no modification primitive.\nA:H - The flaw produced an observed slab-use-after-free crash in seqiv_aead_encrypt, which can cause a fatal KASAN report, oops, or kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:16.622Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/18202537856e0fae079fed2c9308780bcff2bb9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/baf0e2d1e03ddb04781dfe7f22a654d3611f69b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/50f196d2bbaee4ab2494bb1b0d294deba292951a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0279978adec6f1296af66b642cce641c6580be46"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccbb96434d88e32358894c879457b33f7508e798"
        },
        {
          "url": "https://git.kernel.org/stable/c/5476f7f8a311236604b78fcc5b2a63b3a61b0169"
        },
        {
          "url": "https://git.kernel.org/stable/c/50fdb78b7c0bcc550910ef69c0984e751cac72fa"
        }
      ],
      "title": "crypto: seqiv - Do not use req-\u003eiv after crypto_aead_encrypt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71131",
    "datePublished": "2026-01-14T15:07:47.194Z",
    "dateReserved": "2026-01-13T15:30:19.655Z",
    "dateUpdated": "2026-09-08T08:44:01.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23110 (GCVE-0-2026-23110)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-09-08 08:44

Title

scsi: core: Wake up the error handler when final completions race against each other

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running command completes or times out has race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance. First, there is an memory ordering issue within scsi_dec_host_busy(). The write which clears SCMD_STATE_INFLIGHT may be reordered with reads counting in scsi_host_busy(). While the local CPU will see its own write, reordering can allow other CPUs in scsi_dec_host_busy() or scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to see a host busy equal to the host_failed count. This race condition can be prevented with a memory barrier on the error path to force the write to be visible before counting host busy commands. Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By counting busy commands before incrementing host_failed, it can race with a final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does not see host_failed incremented but scsi_eh_inc_host_failed() counts busy commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(), resulting in neither waking the error handler task. This needs the call to scsi_host_busy() to be moved after host_failed is incremented to close the race condition.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/cc872e35c0df80062…
https://git.kernel.org/stable/c/6d9a367be35610196…
https://git.kernel.org/stable/c/9fdc6f28d5e81350a…
https://git.kernel.org/stable/c/64ae21b9c4f0c7e60…
https://git.kernel.org/stable/c/219f009ebfd1ef397…
https://git.kernel.org/stable/c/fe2f8ad6f0999db3b…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 6eb045e092efefafc6687409a6fa6d1dabf0fb69 , < cc872e35c0df80062abc71268d690a2f749e542e (git) Affected: 6eb045e092efefafc6687409a6fa6d1dabf0fb69 , < 6d9a367be356101963c249ebf10ea10b32886607 (git) Affected: 6eb045e092efefafc6687409a6fa6d1dabf0fb69 , < 9fdc6f28d5e81350ab1d2cac8389062bd09e61e1 (git) Affected: 6eb045e092efefafc6687409a6fa6d1dabf0fb69 , < 64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0 (git) Affected: 6eb045e092efefafc6687409a6fa6d1dabf0fb69 , < 219f009ebfd1ef3970888ee9eef4c8a06357f862 (git) Affected: 6eb045e092efefafc6687409a6fa6d1dabf0fb69 , < fe2f8ad6f0999db3b318359a01ee0108c703a8c3 (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.249 , ≤ 5.10.* (semver) Unaffected: 6.1.162 , ≤ 6.1.* (semver) Unaffected: 6.6.122 , ≤ 6.6.* (semver) Unaffected: 6.12.68 , ≤ 6.12.* (semver) Unaffected: 6.18.8 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23110",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:51.689524Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:06.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:44:57.190Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_error.c",
            "drivers/scsi/scsi_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc872e35c0df80062abc71268d690a2f749e542e",
              "status": "affected",
              "version": "6eb045e092efefafc6687409a6fa6d1dabf0fb69",
              "versionType": "git"
            },
            {
              "lessThan": "6d9a367be356101963c249ebf10ea10b32886607",
              "status": "affected",
              "version": "6eb045e092efefafc6687409a6fa6d1dabf0fb69",
              "versionType": "git"
            },
            {
              "lessThan": "9fdc6f28d5e81350ab1d2cac8389062bd09e61e1",
              "status": "affected",
              "version": "6eb045e092efefafc6687409a6fa6d1dabf0fb69",
              "versionType": "git"
            },
            {
              "lessThan": "64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0",
              "status": "affected",
              "version": "6eb045e092efefafc6687409a6fa6d1dabf0fb69",
              "versionType": "git"
            },
            {
              "lessThan": "219f009ebfd1ef3970888ee9eef4c8a06357f862",
              "status": "affected",
              "version": "6eb045e092efefafc6687409a6fa6d1dabf0fb69",
              "versionType": "git"
            },
            {
              "lessThan": "fe2f8ad6f0999db3b318359a01ee0108c703a8c3",
              "status": "affected",
              "version": "6eb045e092efefafc6687409a6fa6d1dabf0fb69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_error.c",
            "drivers/scsi/scsi_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Wake up the error handler when final completions race against each other\n\nThe fragile ordering between marking commands completed or failed so\nthat the error handler only wakes when the last running command\ncompletes or times out has race conditions. These race conditions can\ncause the SCSI layer to fail to wake the error handler, leaving I/O\nthrough the SCSI host stuck as the error state cannot advance.\n\nFirst, there is an memory ordering issue within scsi_dec_host_busy().\nThe write which clears SCMD_STATE_INFLIGHT may be reordered with reads\ncounting in scsi_host_busy(). While the local CPU will see its own\nwrite, reordering can allow other CPUs in scsi_dec_host_busy() or\nscsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to\nsee a host busy equal to the host_failed count.\n\nThis race condition can be prevented with a memory barrier on the error\npath to force the write to be visible before counting host busy\ncommands.\n\nSecond, there is a general ordering issue with scsi_eh_inc_host_failed(). By\ncounting busy commands before incrementing host_failed, it can race with a\nfinal command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does\nnot see host_failed incremented but scsi_eh_inc_host_failed() counts busy\ncommands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(),\nresulting in neither waking the error handler task.\n\nThis needs the call to scsi_host_busy() to be moved after host_failed is\nincremented to close the race condition."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:00:19.004Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc872e35c0df80062abc71268d690a2f749e542e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d9a367be356101963c249ebf10ea10b32886607"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fdc6f28d5e81350ab1d2cac8389062bd09e61e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0"
        },
        {
          "url": "https://git.kernel.org/stable/c/219f009ebfd1ef3970888ee9eef4c8a06357f862"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe2f8ad6f0999db3b318359a01ee0108c703a8c3"
        }
      ],
      "title": "scsi: core: Wake up the error handler when final completions race against each other",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23110",
    "datePublished": "2026-02-04T16:08:30.158Z",
    "dateReserved": "2026-01-13T15:37:45.968Z",
    "dateUpdated": "2026-09-08T08:44:57.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23375 (GCVE-0-2026-23375)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-05-11 22:05

Title

mm: thp: deny THP for files on anonymous inodes

Summary

In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_file_pseudo(), which does not call get_write_access() and leaves inode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being true, they appear as read-only regular files when CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP collapse. Anonymous inodes can never pass the inode_is_open_for_write() check since their i_writecount is never incremented through the normal VFS open path. The right thing to do is to exclude them from THP eligibility altogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real filesystem files (e.g. shared libraries), not for pseudo-filesystem inodes. For guest_memfd, this allows khugepaged and MADV_COLLAPSE to create large folios in the page cache via the collapse path, but the guest_memfd fault handler does not support large folios. This triggers WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping(). For secretmem, collapse_file() tries to copy page contents through the direct map, but secretmem pages are removed from the direct map. This can result in a kernel crash: BUG: unable to handle page fault for address: ffff88810284d000 RIP: 0010:memcpy_orig+0x16/0x130 Call Trace: collapse_file hpage_collapse_scan_file madvise_collapse Secretmem is not affected by the crash on upstream as the memory failure recovery handles the failed copy gracefully, but it still triggers confusing false memory failure reports: Memory failure: 0x106d96f: recovery action for clean unevictable LRU page: Recovered Check IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all anonymous inode files.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/08de46a75f91a6661…
https://git.kernel.org/stable/c/0524ee56af2c9bfba…
https://git.kernel.org/stable/c/f6fa05f0dddd38741…
https://git.kernel.org/stable/c/dd085fe9a8ebfc5d1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7fbb5e188248c50f737720825da1864ce42536d1 , < 08de46a75f91a6661bc1ce0a93614f4bc313c581 (git) Affected: 7fbb5e188248c50f737720825da1864ce42536d1 , < 0524ee56af2c9bfbad152a810f1ca95de8ca00d7 (git) Affected: 7fbb5e188248c50f737720825da1864ce42536d1 , < f6fa05f0dddd387417d0c28281ddb951582514d6 (git) Affected: 7fbb5e188248c50f737720825da1864ce42536d1 , < dd085fe9a8ebfc5d10314c60452db38d2b75e609 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.78 , ≤ 6.12.* (semver) Unaffected: 6.18.17 , ≤ 6.18.* (semver) Unaffected: 6.19.7 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08de46a75f91a6661bc1ce0a93614f4bc313c581",
              "status": "affected",
              "version": "7fbb5e188248c50f737720825da1864ce42536d1",
              "versionType": "git"
            },
            {
              "lessThan": "0524ee56af2c9bfbad152a810f1ca95de8ca00d7",
              "status": "affected",
              "version": "7fbb5e188248c50f737720825da1864ce42536d1",
              "versionType": "git"
            },
            {
              "lessThan": "f6fa05f0dddd387417d0c28281ddb951582514d6",
              "status": "affected",
              "version": "7fbb5e188248c50f737720825da1864ce42536d1",
              "versionType": "git"
            },
            {
              "lessThan": "dd085fe9a8ebfc5d10314c60452db38d2b75e609",
              "status": "affected",
              "version": "7fbb5e188248c50f737720825da1864ce42536d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: thp: deny THP for files on anonymous inodes\n\nfile_thp_enabled() incorrectly allows THP for files on anonymous inodes\n(e.g. guest_memfd and secretmem). These files are created via\nalloc_file_pseudo(), which does not call get_write_access() and leaves\ninode-\u003ei_writecount at 0. Combined with S_ISREG(inode-\u003ei_mode) being\ntrue, they appear as read-only regular files when\nCONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP\ncollapse.\n\nAnonymous inodes can never pass the inode_is_open_for_write() check\nsince their i_writecount is never incremented through the normal VFS\nopen path. The right thing to do is to exclude them from THP eligibility\naltogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real\nfilesystem files (e.g. shared libraries), not for pseudo-filesystem\ninodes.\n\nFor guest_memfd, this allows khugepaged and MADV_COLLAPSE to create\nlarge folios in the page cache via the collapse path, but the\nguest_memfd fault handler does not support large folios. This triggers\nWARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping().\n\nFor secretmem, collapse_file() tries to copy page contents through the\ndirect map, but secretmem pages are removed from the direct map. This\ncan result in a kernel crash:\n\n    BUG: unable to handle page fault for address: ffff88810284d000\n    RIP: 0010:memcpy_orig+0x16/0x130\n    Call Trace:\n     collapse_file\n     hpage_collapse_scan_file\n     madvise_collapse\n\nSecretmem is not affected by the crash on upstream as the memory failure\nrecovery handles the failed copy gracefully, but it still triggers\nconfusing false memory failure reports:\n\n    Memory failure: 0x106d96f: recovery action for clean unevictable\n    LRU page: Recovered\n\nCheck IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all\nanonymous inode files."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:05:39.614Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08de46a75f91a6661bc1ce0a93614f4bc313c581"
        },
        {
          "url": "https://git.kernel.org/stable/c/0524ee56af2c9bfbad152a810f1ca95de8ca00d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6fa05f0dddd387417d0c28281ddb951582514d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd085fe9a8ebfc5d10314c60452db38d2b75e609"
        }
      ],
      "title": "mm: thp: deny THP for files on anonymous inodes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23375",
    "datePublished": "2026-03-25T10:27:55.754Z",
    "dateReserved": "2026-01-13T15:37:46.003Z",
    "dateUpdated": "2026-05-11T22:05:39.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23455 (GCVE-0-2026-23455)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-09-08 08:46

Title

netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/2121f5fbe88daff0f…
https://git.kernel.org/stable/c/65fa92f79677858b1…
https://git.kernel.org/stable/c/495e97af9e7249ee0…
https://git.kernel.org/stable/c/f5e4f4e4cdb75ec36…
https://git.kernel.org/stable/c/633e8f87dad32263f…
https://git.kernel.org/stable/c/9d00fe7d6d7c5b5f1…
https://git.kernel.org/stable/c/b652b05d51003ac07…
https://git.kernel.org/stable/c/f173d0f4c0f689173…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < 2121f5fbe88daff0f1fc5bc47d359426c74b86b0 (git) Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < 65fa92f79677858b14b9e4b7275f26639afe2710 (git) Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < 495e97af9e7249ee02b72bb1d0848a6efc3700f4 (git) Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < f5e4f4e4cdb75ec36802059a94195a31f193da60 (git) Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < 633e8f87dad32263f6a57dccdb873f042c062111 (git) Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < 9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8 (git) Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < b652b05d51003ac074b912684f9ec7486231717b (git) Affected: 5e35941d990123f155b02d5663e51a24f816b6f3 , < f173d0f4c0f689173f8cdac79991043a4a89bf66 (git)
Linux	Linux	Affected: 2.6.17 Unaffected: 0 , < 2.6.17 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.78 , ≤ 6.12.* (semver) Unaffected: 6.18.20 , ≤ 6.18.* (semver) Unaffected: 6.19.10 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:46:22.074Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_h323_asn1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2121f5fbe88daff0f1fc5bc47d359426c74b86b0",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            },
            {
              "lessThan": "65fa92f79677858b14b9e4b7275f26639afe2710",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            },
            {
              "lessThan": "495e97af9e7249ee02b72bb1d0848a6efc3700f4",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            },
            {
              "lessThan": "f5e4f4e4cdb75ec36802059a94195a31f193da60",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            },
            {
              "lessThan": "633e8f87dad32263f6a57dccdb873f042c062111",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            },
            {
              "lessThan": "9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            },
            {
              "lessThan": "b652b05d51003ac074b912684f9ec7486231717b",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            },
            {
              "lessThan": "f173d0f4c0f689173f8cdac79991043a4a89bf66",
              "status": "affected",
              "version": "5e35941d990123f155b02d5663e51a24f816b6f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_h323_asn1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.17"
            },
            {
              "lessThan": "2.6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: check for zero length in DecodeQ931()\n\nIn DecodeQ931(), the UserUserIE code path reads a 16-bit length from\nthe packet, then decrements it by 1 to skip the protocol discriminator\nbyte before passing it to DecodeH323_UserInformation(). If the encoded\nlength is 0, the decrement wraps to -1, which is then passed as a\nlarge value to the decoder, leading to an out-of-bounds read.\n\nAdd a check to ensure len is positive after the decrement."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable H.323/Q.931 conntrack helper parses TCP network traffic, typically on H.323 call signaling flows through a firewall/NAT gateway. A remote peer can supply the malformed TPKT/Q.931 packet once the helper is active for that flow.\nAC:L - The trigger is a deterministic zero-length UserUserIE in an otherwise reachable Q.931 message; there is no race or condition outside the attacker\u0027s control. TCP establishment and helper deployment are normal operating conditions for the affected subsystem.\nPR:N - The attacker only needs to send network traffic to or through a system using the H.323 conntrack helper. No authentication or local privileges are required on the target system.\nUI:N - Exploitation occurs during automatic packet processing in the kernel netfilter path. No victim user action is required.\nS:U - The vulnerable component and impacted resources are within the same kernel/network filtering security authority. This is not a VM escape, IOMMU bypass, or cross-sandbox boundary violation.\nC:H - The integer underflow turns a zero encoded length into a huge decoder length, causing an out-of-bounds read beyond the packet buffer. Under the kernel guidance, an unbounded out-of-bounds read is High confidentiality impact.\nI:N - The bug is a read-side parser bounds failure and does not provide an out-of-bounds write, arbitrary write primitive, or direct control-flow corruption. Any resulting malformed conntrack processing is not enough to justify kernel data integrity compromise.\nA:H - The out-of-bounds read can fault or otherwise destabilize kernel packet processing, producing an oops/panic or repeated denial of service. A remote attacker can resend malformed packets to retrigger it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:54.080Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2121f5fbe88daff0f1fc5bc47d359426c74b86b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/65fa92f79677858b14b9e4b7275f26639afe2710"
        },
        {
          "url": "https://git.kernel.org/stable/c/495e97af9e7249ee02b72bb1d0848a6efc3700f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5e4f4e4cdb75ec36802059a94195a31f193da60"
        },
        {
          "url": "https://git.kernel.org/stable/c/633e8f87dad32263f6a57dccdb873f042c062111"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b652b05d51003ac074b912684f9ec7486231717b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f173d0f4c0f689173f8cdac79991043a4a89bf66"
        }
      ],
      "title": "netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23455",
    "datePublished": "2026-04-03T15:15:36.869Z",
    "dateReserved": "2026-01-13T15:37:46.020Z",
    "dateUpdated": "2026-09-08T08:46:22.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31488 (GCVE-0-2026-31488)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-17 12:04

Title

drm/amd/display: Do not skip unrelated mode changes in DSC validation

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC state mode_changed flag to false when recomputing the DSC configuration results in no timing change for a particular stream. However, this is incorrect in scenarios where a change in MST/DSC configuration happens in the same KMS commit as another (unrelated) mode change. For example, the integrated panel of a laptop may be configured differently (e.g., HDR enabled/disabled) depending on whether external screens are attached. In this case, plugging in external DP-MST screens may result in the mode_changed flag being dropped incorrectly for the integrated panel if its DSC configuration did not change during precomputation in pre_validate_dsc(). At this point, however, dm_update_crtc_state() has already created new streams for CRTCs with DSC-independent mode changes. In turn, amdgpu_dm_commit_streams() will never release the old stream, resulting in a memory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to the new stream either, which manifests as a use-after-free when the stream gets disabled later on: BUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu] Write of size 4 at addr ffff88813d836524 by task kworker/9:9/29977 Workqueue: events drm_mode_rmfb_work_fn Call Trace: <TASK> dump_stack_lvl+0x6e/0xa0 print_address_description.constprop.0+0x88/0x320 ? dc_stream_release+0x25/0x90 [amdgpu] print_report+0xfc/0x1ff ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x225/0x4e0 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_report+0xe1/0x180 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_check_range+0x125/0x200 dc_stream_release+0x25/0x90 [amdgpu] dc_state_destruct+0x14d/0x5c0 [amdgpu] dc_state_release.part.0+0x4e/0x130 [amdgpu] dm_atomic_destroy_state+0x3f/0x70 [amdgpu] drm_atomic_state_default_clear+0x8ee/0xf30 ? drm_mode_object_put.part.0+0xb1/0x130 __drm_atomic_state_free+0x15c/0x2d0 atomic_remove_fb+0x67e/0x980 Since there is no reliable way of figuring out whether a CRTC has unrelated mode changes pending at the time of DSC validation, remember the value of the mode_changed flag from before the point where a CRTC was marked as potentially affected by a change in DSC configuration. Reset the mode_changed flag to this earlier value instead in pre_validate_dsc(). (cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-1288 - Improper Validation of Consistency within Input

Assigner

Linux mitre root

References

19 references

URL	Tags
https://git.kernel.org/stable/c/da1d0ed31e9802fd9…
https://git.kernel.org/stable/c/21159d8b335a6b9f4…
https://git.kernel.org/stable/c/10862e344b4d64346…
https://git.kernel.org/stable/c/8a5edc97fd9c6415f…
https://git.kernel.org/stable/c/111208b5b7ebcdadb…
https://git.kernel.org/stable/c/aed3d041ab061ec8a…
https://access.redhat.com/security/cve/CVE-2026-31488	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2460619	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:55445	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53330	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47739	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43231	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44385	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30848	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27353	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47869	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27354	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47632	vendor-advisoryx_refsource_REDHAT

Impacted products

16 products

Vendor	Product	Version
Linux	Linux	Affected: 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b , < da1d0ed31e9802fd99384f43cc63678a5a11cb41 (git) Affected: 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b , < 21159d8b335a6b9f44cbb506733013a902ae2da4 (git) Affected: 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b , < 10862e344b4d6434642a48c87d765813fc0b0ba7 (git) Affected: 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b , < 8a5edc97fd9c6415ff2eff872748439a97e3c3d8 (git) Affected: 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b , < 111208b5b7ebcdadb3f922cc52d8425f0fa91b33 (git) Affected: 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b , < aed3d041ab061ec8a64f50a3edda0f4db7280025 (git)
Linux	Linux	Affected: 5.18 Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.46.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.98.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.rt7.477.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.156.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.156.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.19.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.183.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.183.1.rt14.468.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.139.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.129.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.46.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.98.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.rt7.477.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.156.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.156.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.19.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.183.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.183.1.rt14.468.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.139.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.129.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-22T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression (DSC) processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a memory leak and a use-after-free error. This could result in system crashes, denial of service, or potentially allow the attacker to gain elevated privileges."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1288",
                "description": "Improper Validation of Consistency within Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T12:04:49.431Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31488"
          },
          {
            "name": "RHBZ#2460619",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460619"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31488.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55445"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53330"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47739"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43231"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44385"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30848"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27353"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47869"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27354"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47632"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53330: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47739: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43231: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44385: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30848: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27353: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47869: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27354: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47632: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-22T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-22T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "da1d0ed31e9802fd99384f43cc63678a5a11cb41",
              "status": "affected",
              "version": "17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b",
              "versionType": "git"
            },
            {
              "lessThan": "21159d8b335a6b9f44cbb506733013a902ae2da4",
              "status": "affected",
              "version": "17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b",
              "versionType": "git"
            },
            {
              "lessThan": "10862e344b4d6434642a48c87d765813fc0b0ba7",
              "status": "affected",
              "version": "17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b",
              "versionType": "git"
            },
            {
              "lessThan": "8a5edc97fd9c6415ff2eff872748439a97e3c3d8",
              "status": "affected",
              "version": "17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b",
              "versionType": "git"
            },
            {
              "lessThan": "111208b5b7ebcdadb3f922cc52d8425f0fa91b33",
              "status": "affected",
              "version": "17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b",
              "versionType": "git"
            },
            {
              "lessThan": "aed3d041ab061ec8a64f50a3edda0f4db7280025",
              "status": "affected",
              "version": "17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not skip unrelated mode changes in DSC validation\n\nStarting with commit 17ce8a6907f7 (\"drm/amd/display: Add dsc pre-validation in\natomic check\"), amdgpu resets the CRTC state mode_changed flag to false when\nrecomputing the DSC configuration results in no timing change for a particular\nstream.\n\nHowever, this is incorrect in scenarios where a change in MST/DSC configuration\nhappens in the same KMS commit as another (unrelated) mode change. For example,\nthe integrated panel of a laptop may be configured differently (e.g., HDR\nenabled/disabled) depending on whether external screens are attached. In this\ncase, plugging in external DP-MST screens may result in the mode_changed flag\nbeing dropped incorrectly for the integrated panel if its DSC configuration\ndid not change during precomputation in pre_validate_dsc().\n\nAt this point, however, dm_update_crtc_state() has already created new streams\nfor CRTCs with DSC-independent mode changes. In turn,\namdgpu_dm_commit_streams() will never release the old stream, resulting in a\nmemory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to\nthe new stream either, which manifests as a use-after-free when the stream gets\ndisabled later on:\n\nBUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu]\nWrite of size 4 at addr ffff88813d836524 by task kworker/9:9/29977\n\nWorkqueue: events drm_mode_rmfb_work_fn\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x6e/0xa0\n print_address_description.constprop.0+0x88/0x320\n ? dc_stream_release+0x25/0x90 [amdgpu]\n print_report+0xfc/0x1ff\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x225/0x4e0\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_report+0xe1/0x180\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_check_range+0x125/0x200\n dc_stream_release+0x25/0x90 [amdgpu]\n dc_state_destruct+0x14d/0x5c0 [amdgpu]\n dc_state_release.part.0+0x4e/0x130 [amdgpu]\n dm_atomic_destroy_state+0x3f/0x70 [amdgpu]\n drm_atomic_state_default_clear+0x8ee/0xf30\n ? drm_mode_object_put.part.0+0xb1/0x130\n __drm_atomic_state_free+0x15c/0x2d0\n atomic_remove_fb+0x67e/0x980\n\nSince there is no reliable way of figuring out whether a CRTC has unrelated\nmode changes pending at the time of DSC validation, remember the value of the\nmode_changed flag from before the point where a CRTC was marked as potentially\naffected by a change in DSC configuration. Reset the mode_changed flag to this\nearlier value instead in pre_validate_dsc().\n\n(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local DRM/KMS ioctls, especially DRM_IOCTL_MODE_ATOMIC on an amdgpu primary device, not through network input.\nAC:L - On an affected AMD display setup with DSC/MST-capable outputs, the bad state transition is deterministically triggered by a crafted atomic modeset combining MST/DSC changes with an unrelated mode change.\nPR:L - The attacker must be a local DRM client with access to the primary node and current DRM master capability; this is attainable by an unprivileged graphical-session user and does not require real root.\nUI:N - Once the attacker has the local DRM access, exploitation is driven by ioctls and later framebuffer/CRTC teardown without requiring a separate victim action.\nS:U - The corruption occurs within the kernel display driver and affects the same kernel security authority, with no VM escape or cross-scope boundary involved.\nC:H - The bug creates a use-after-free of a kernel dc_stream_state object, and kernel UAF memory corruption is defensibly capable of exposing arbitrary kernel memory.\nI:H - The observed failure is a write through kref_put to a freed object, and a reclaimable kernel UAF write can be shaped into memory corruption or control-flow compromise.\nA:H - The commit documents a KASAN use-after-free in dc_stream_release, and this class of kernel memory corruption can reliably crash or destabilize the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:01.480Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/da1d0ed31e9802fd99384f43cc63678a5a11cb41"
        },
        {
          "url": "https://git.kernel.org/stable/c/21159d8b335a6b9f44cbb506733013a902ae2da4"
        },
        {
          "url": "https://git.kernel.org/stable/c/10862e344b4d6434642a48c87d765813fc0b0ba7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a5edc97fd9c6415ff2eff872748439a97e3c3d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/111208b5b7ebcdadb3f922cc52d8425f0fa91b33"
        },
        {
          "url": "https://git.kernel.org/stable/c/aed3d041ab061ec8a64f50a3edda0f4db7280025"
        }
      ],
      "title": "drm/amd/display: Do not skip unrelated mode changes in DSC validation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31488",
    "datePublished": "2026-04-22T13:54:12.963Z",
    "dateReserved": "2026-03-09T15:48:24.101Z",
    "dateUpdated": "2026-08-17T12:04:49.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43279 (GCVE-0-2026-43279)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:29 – Updated: 2026-08-05 12:27

Title

ALSA: usb-audio: Add sanity check for OOB writes at silencing

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the buffer size. But when the setup in the capture stream differs from the playback stream (e.g. due to the USB core limitation of max packet size), such an inconsistency may lead to OOB writes to the buffer, resulting in a crash. For addressing it, add a sanity check of the transfer buffer size at prepare_silent_urb(), and stop the data copy if the received data overflows. Also, report back the transfer error properly from there, too. Note that this doesn't fix the root cause of the playback error itself, but this merely covers the kernel Oops.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/fa01973bb79d70c47…
https://git.kernel.org/stable/c/780dc57794a217b49…
https://git.kernel.org/stable/c/8995fc0e00b3fee9b…
https://git.kernel.org/stable/c/fc9e5af60dc199051…
https://git.kernel.org/stable/c/6af16f1b8649df4c0…
https://git.kernel.org/stable/c/ccaf9296763be4f76…
https://git.kernel.org/stable/c/fba2105a157fffcf1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 , < fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f (git) Affected: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 , < 780dc57794a217b49994fa1d0b42465fb10a00aa (git) Affected: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 , < 8995fc0e00b3fee9bf7ecb3d836b635b730c1049 (git) Affected: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 , < fc9e5af60dc199051dc202ae78e1fe76a9977a5e (git) Affected: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 , < 6af16f1b8649df4c00d6ced924bdd8b72c885b6a (git) Affected: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 , < ccaf9296763be4f76b59e2cac377006016c34435 (git) Affected: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 , < fba2105a157fffcf19825e4eea498346738c9948 (git)
Linux	Linux	Affected: 3.5 Unaffected: 0 , < 3.5 (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/endpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f",
              "status": "affected",
              "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
              "versionType": "git"
            },
            {
              "lessThan": "780dc57794a217b49994fa1d0b42465fb10a00aa",
              "status": "affected",
              "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
              "versionType": "git"
            },
            {
              "lessThan": "8995fc0e00b3fee9bf7ecb3d836b635b730c1049",
              "status": "affected",
              "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
              "versionType": "git"
            },
            {
              "lessThan": "fc9e5af60dc199051dc202ae78e1fe76a9977a5e",
              "status": "affected",
              "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
              "versionType": "git"
            },
            {
              "lessThan": "6af16f1b8649df4c00d6ced924bdd8b72c885b6a",
              "status": "affected",
              "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
              "versionType": "git"
            },
            {
              "lessThan": "ccaf9296763be4f76b59e2cac377006016c34435",
              "status": "affected",
              "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
              "versionType": "git"
            },
            {
              "lessThan": "fba2105a157fffcf19825e4eea498346738c9948",
              "status": "affected",
              "version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/endpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Add sanity check for OOB writes at silencing\n\nAt silencing the playback URB packets in the implicit fb mode before\nthe actual playback, we blindly assume that the received packets fit\nwith the buffer size.  But when the setup in the capture stream\ndiffers from the playback stream (e.g. due to the USB core limitation\nof max packet size), such an inconsistency may lead to OOB writes to\nthe buffer, resulting in a crash.\n\nFor addressing it, add a sanity check of the transfer buffer size at\nprepare_silent_urb(), and stop the data copy if the received data\noverflows.  Also, report back the transfer error properly from there,\ntoo.\n\nNote that this doesn\u0027t fix the root cause of the playback error\nitself, but this merely covers the kernel Oops."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is exercised through local ALSA PCM device-file operations such as open, hw_params, prepare, and trigger/write on a USB audio PCM device. It is not network reachable, but a local user can drive the stream path once a susceptible USB audio device is present.\nAC:L - There is no race or hard-to-hit timing condition; the overflow follows deterministically when implicit-feedback packet sizes exceed the playback URB buffer. A malicious or affected device plus chosen stream parameters can repeatedly drive the bad packet-size path.\nPR:L - The ALSA PCM path does not require CAP_SYS_ADMIN or another kernel capability, only permission to access the relevant /dev/snd PCM node as a normal local audio user/session. User namespaces are not needed.\nUI:N - A local attacker with PCM device access can open, configure, and start the stream directly. No separate victim action is required for that local attack path.\nS:U - The corruption occurs within the host kernel USB audio/ALSA subsystem and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds write into kernel USB transfer-buffer memory, which is kernel memory corruption. Even though the reported symptom is an oops, such corruption can plausibly be leveraged for information disclosure.\nI:H - The vulnerable code writes past the allocated URB transfer buffer while preparing silent playback packets. Out-of-bounds kernel writes are high-integrity impact because they can corrupt adjacent kernel state and potentially enable control-flow or data modification.\nA:H - The commit explicitly describes resulting kernel oops/crash behavior, and the fix only bounds the write to prevent that crash. The trigger can be repeated by starting the affected stream again."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:01.240Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435"
        },
        {
          "url": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948"
        }
      ],
      "title": "ALSA: usb-audio: Add sanity check for OOB writes at silencing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43279",
    "datePublished": "2026-05-06T11:29:00.844Z",
    "dateReserved": "2026-05-01T14:12:55.998Z",
    "dateUpdated": "2026-08-05T12:27:01.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45998 (GCVE-0-2026-45998)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:55 – Updated: 2026-09-09 12:04

Title

rxrpc: Fix potential UAF after skb_unshare() failure

Summary

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread()) will be NULL'd out. This will likely cause the call to trace_rxrpc_rx_done() to oops. Fix this by moving the unsharing down to where rxrpc_input_call_event() calls rxrpc_input_call_packet(). There are a number of places prior to that where we ignore DATA packets for a variety of reasons (such as the call already being complete) for which an unshare is then avoided. And with that, rxrpc_input_packet() doesn't need to take a pointer to the pointer to the packet, so change that to just a pointer.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-825 - Expired Pointer Dereference

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/e3bf143b1e98fb3d6…
https://git.kernel.org/stable/c/bf20f46d94f1db38e…
https://git.kernel.org/stable/c/996b0487b3cdda4c9…
https://git.kernel.org/stable/c/8fde6296c4d4da2be…
https://git.kernel.org/stable/c/1f2740150f904bfa6…
https://access.redhat.com/security/cve/CVE-2026-45998	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2482024	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:55445	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65708	vendor-advisoryx_refsource_REDHAT

Impacted products

10 products

Vendor	Product	Version
Linux	Linux	Affected: 2d1faf7a0ca3c0b327cf064c80e4e775532c9319 , < e3bf143b1e98fb3d6d9e6825bcd683974d478e8c (git) Affected: 2d1faf7a0ca3c0b327cf064c80e4e775532c9319 , < bf20f46d94f1db38e6ffc0ca204a5fe0de01b495 (git) Affected: 2d1faf7a0ca3c0b327cf064c80e4e775532c9319 , < 996b0487b3cdda4c91811dbb1c9564626bc840bd (git) Affected: 2d1faf7a0ca3c0b327cf064c80e4e775532c9319 , < 8fde6296c4d4da2be7ab761305ab7f232b94eefd (git) Affected: 2d1faf7a0ca3c0b327cf064c80e4e775532c9319 , < 1f2740150f904bfa60e4bad74d65add3ccb5e7f8 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.30.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.98.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.149.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.140.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.30.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.98.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.149.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.140.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-27T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `rxrpc` subsystem. This vulnerability arises when the system attempts to unshare a packet buffer, and the operation fails due to an allocation issue. This failure can lead to a Use-After-Free (UAF) condition, where the system attempts to access memory that has been freed, potentially causing a system crash."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T12:04:59.609Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-45998"
          },
          {
            "name": "RHBZ#2482024",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482024"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45998.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55445"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65708"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65712: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-27T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-27T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: rxrpc: Fix potential UAF after skb_unshare() failure",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/io_thread.c",
            "net/rxrpc/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3bf143b1e98fb3d6d9e6825bcd683974d478e8c",
              "status": "affected",
              "version": "2d1faf7a0ca3c0b327cf064c80e4e775532c9319",
              "versionType": "git"
            },
            {
              "lessThan": "bf20f46d94f1db38e6ffc0ca204a5fe0de01b495",
              "status": "affected",
              "version": "2d1faf7a0ca3c0b327cf064c80e4e775532c9319",
              "versionType": "git"
            },
            {
              "lessThan": "996b0487b3cdda4c91811dbb1c9564626bc840bd",
              "status": "affected",
              "version": "2d1faf7a0ca3c0b327cf064c80e4e775532c9319",
              "versionType": "git"
            },
            {
              "lessThan": "8fde6296c4d4da2be7ab761305ab7f232b94eefd",
              "status": "affected",
              "version": "2d1faf7a0ca3c0b327cf064c80e4e775532c9319",
              "versionType": "git"
            },
            {
              "lessThan": "1f2740150f904bfa60e4bad74d65add3ccb5e7f8",
              "status": "affected",
              "version": "2d1faf7a0ca3c0b327cf064c80e4e775532c9319",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_event.c",
            "net/rxrpc/io_thread.c",
            "net/rxrpc/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix potential UAF after skb_unshare() failure\n\nIf skb_unshare() fails to unshare a packet due to allocation failure in\nrxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread())\nwill be NULL\u0027d out.  This will likely cause the call to\ntrace_rxrpc_rx_done() to oops.\n\nFix this by moving the unsharing down to where rxrpc_input_call_event()\ncalls rxrpc_input_call_packet().  There are a number of places prior to\nthat where we ignore DATA packets for a variety of reasons (such as the\ncall already being complete) for which an unshare is then avoided.\n\nAnd with that, rxrpc_input_packet() doesn\u0027t need to take a pointer to the\npointer to the packet, so change that to just a pointer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:47:06.713Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3bf143b1e98fb3d6d9e6825bcd683974d478e8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf20f46d94f1db38e6ffc0ca204a5fe0de01b495"
        },
        {
          "url": "https://git.kernel.org/stable/c/996b0487b3cdda4c91811dbb1c9564626bc840bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fde6296c4d4da2be7ab761305ab7f232b94eefd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f2740150f904bfa60e4bad74d65add3ccb5e7f8"
        }
      ],
      "title": "rxrpc: Fix potential UAF after skb_unshare() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45998",
    "datePublished": "2026-05-27T12:55:52.756Z",
    "dateReserved": "2026-05-13T15:03:33.091Z",
    "dateUpdated": "2026-09-09T12:04:59.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53000 (GCVE-0-2026-53000)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-09-09 12:04

Title

netfilter: nat: use kfree_rcu to release ops

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-763 - Release of Invalid Pointer or Reference

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/32fdd2e38e7435a36…
https://git.kernel.org/stable/c/3c7511f38ab511b79…
https://git.kernel.org/stable/c/6eda0d771f94267f7…
https://access.redhat.com/security/cve/CVE-2026-53000	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492273	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:55445	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64808	vendor-advisoryx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 , < 32fdd2e38e7435a368d88f5977a7d6585ebc8b0e (git) Affected: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 , < 3c7511f38ab511b791196b13ae48bf4973bf7dfd (git) Affected: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 , < 6eda0d771f94267f73f57c94630aa47e90957915 (git)
Linux	Linux	Affected: 5.14 Unaffected: 0 , < 5.14 (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.98.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.45.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.98.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.45.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s netfilter component, specifically within the Network Address Translation (NAT) subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system crash, leading to a Denial of Service (DoS), or to gain unauthorized access to sensitive information due to the partial exposure of internal hook data during error handling."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-763",
                "description": "Release of Invalid Pointer or Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T12:04:52.182Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53000"
          },
          {
            "name": "RHBZ#2492273",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492273"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53000.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55445"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:64808"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:64808: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: netfilter: nat: use kfree_rcu to release ops",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/netfilter/iptable_nat.c",
            "net/ipv6/netfilter/ip6table_nat.c",
            "net/netfilter/nf_nat_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "32fdd2e38e7435a368d88f5977a7d6585ebc8b0e",
              "status": "affected",
              "version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
              "versionType": "git"
            },
            {
              "lessThan": "3c7511f38ab511b791196b13ae48bf4973bf7dfd",
              "status": "affected",
              "version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
              "versionType": "git"
            },
            {
              "lessThan": "6eda0d771f94267f73f57c94630aa47e90957915",
              "status": "affected",
              "version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/netfilter/iptable_nat.c",
            "net/ipv6/netfilter/ip6table_nat.c",
            "net/netfilter/nf_nat_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nat: use kfree_rcu to release ops\n\nFlorian Westphal says:\n\n\"Historically this is not an issue, even for normal base hooks: the data\npath doesn\u0027t use the original nf_hook_ops that are used to register the\ncallbacks.\n\nHowever, in v5.14 I added the ability to dump the active netfilter\nhooks from userspace.\n\nThis code will peek back into the nf_hook_ops that are available\nat the tail of the pointer-array blob used by the datapath.\n\nThe nat hooks are special, because they are called indirectly from\nthe central nat dispatcher hook. They are currently invisible to\nthe nfnl hook dump subsystem though.\n\nBut once that changes the nat ops structures have to be deferred too.\"\n\nUpdate nf_nat_register_fn() to deal with partial exposition of the hooks\nfrom error path which can be also an issue for nfnetlink_hook."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local netfilter/nfnetlink operations, including hook dumps and NAT hook registration/unregistration via netlink or xtables control paths. Remote packets may traverse NAT hooks, but the unsafe freed nf_hook_ops metadata is exposed through local control-plane operations.\nAC:L - The relevant race is between hook dumping and NAT hook teardown/error unwind, and an attacker with netfilter control can drive both sides concurrently. There are no required conditions outside the attacker\u2019s influence beyond normal scheduling.\nPR:L - The paths require CAP_NET_ADMIN in the target network namespace. Netfilter/nftables operations are reachable by an unprivileged local user through user and network namespaces, so this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution. The attacker can issue the netlink/xtables operations directly.\nS:U - The impact is within the same kernel security authority and represents a standard local kernel memory-safety issue. It does not cross a VM, IOMMU, or similar separate security boundary.\nC:H - This is a use-after-free of kernel heap objects referenced by RCU-visible hook metadata. Reclaiming the freed object can drive kernel reads through attacker-influenced nf_hook_ops fields, making high confidentiality impact defensible.\nI:H - A kernel use-after-free is a memory corruption primitive and may be leveraged beyond a crash with heap grooming. Following the higher-severity rule for UAFs, arbitrary modification or code execution is defensible.\nA:H - The stale hook metadata can be dereferenced after free in kernel context. At minimum this can cause an oops/panic, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:31.130Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915"
        }
      ],
      "title": "netfilter: nat: use kfree_rcu to release ops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53000",
    "datePublished": "2026-06-24T16:29:12.635Z",
    "dateReserved": "2026-06-09T07:44:35.377Z",
    "dateUpdated": "2026-09-09T12:04:52.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:55445

CVE-2025-10263 (GCVE-0-2025-10263)

CVE-2025-71089 (GCVE-0-2025-71089)

CVE-2025-71131 (GCVE-0-2025-71131)

CVE-2026-23110 (GCVE-0-2026-23110)

CVE-2026-23375 (GCVE-0-2026-23375)

CVE-2026-23455 (GCVE-0-2026-23455)

CVE-2026-31488 (GCVE-0-2026-31488)

CVE-2026-43279 (GCVE-0-2026-43279)

CVE-2026-45998 (GCVE-0-2026-45998)

CVE-2026-53000 (GCVE-0-2026-53000)

Tags

Sightings

Nomenclature