{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.53.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.46.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-06T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) nSVM module. When a nested virtual machine (L2 guest) executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor (L1), KVM incorrectly uses `vmcb02` instead of `vmcb01` for managing guest state. This incorrect Virtual Machine Control Block (VMCB) handling could lead to unexpected behavior or state corruption within the virtualized environment."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.9,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-628",
                "description": "Function Call with Incorrectly Specified Arguments",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T12:04:52.427Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43133"
          },
          {
            "name": "RHBZ#2467065",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65334"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66180"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:65334: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66180: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10063e1251c1485034a018236080792ad083dcc5",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "c3b7015000988ba35ecd5648f4b2283960f00543",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "3880e331b0b31d0d5d3702b124f6c93539cd478a",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "fce2fd4a2ca05670a91015aacccf96a1c26268fd",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "d464cf1ed900d47c85393d40b00017b6adfc2e6c",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "0004ecb798b30e90d7ebfe74efae2d9423315a64",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "127ccae2c185f62e6ecb4bf24f9cb307e9b9c619",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by locally running a KVM vCPU through /dev/kvm and executing nested SVM VMLOAD/VMSAVE from an L2 guest; it is not reachable via network packets.\nAC:L - The trigger is deterministic once nested SVM is available: configure L1 not to intercept VMLOAD/VMSAVE and execute the instruction in L2. No race or attacker-uncontrolled timing condition is required.\nPR:L - The attacker needs the ability to create/run a KVM VM or execute code in a nested guest, which is local low privilege where /dev/kvm is delegated. No real init-namespace root capability is required by the vulnerable emulation path itself.\nUI:N - After the VM/nested guest is running, exploitation is triggered solely by guest instruction execution. No additional victim user action is required.\nS:C - The bug is in KVM\u2019s enforcement of the nested virtualization boundary, where L2 execution causes KVM to operate on the wrong L0-maintained VMCB state. That can affect resources outside the L2 guest\u2019s own security authority.\nC:L - VMSAVE can copy bounded VMLOAD/VMSAVE save-state fields from the wrong internal VMCB into guest-accessible memory. I did not identify an arbitrary host-memory read primitive, so the defensible confidentiality impact is limited.\nI:L - VMLOAD can corrupt a bounded set of VMLOAD/VMSAVE state fields in the wrong KVM VMCB, causing incorrect nested guest/L1 state handling. I did not find a direct arbitrary host write or host code execution primitive.\nA:H - The wrong VMCB state can make nested VM execution fail or crash/hang the affected virtual machine/vCPU, and the attacker can trigger it repeatedly. This is a complete availability impact for the affected nested virtualization workload, even though I did not find a host kernel panic path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:09.214Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543"
        },
        {
          "url": "https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64"
        },
        {
          "url": "https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619"
        }
      ],
      "title": "KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43133",
    "datePublished": "2026-05-06T11:27:20.882Z",
    "dateReserved": "2026-05-01T14:12:55.988Z",
    "dateUpdated": "2026-09-10T12:04:52.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "425a22c5373d4e1b46492ab869074ebeeade61f3",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            },
            {
              "lessThan": "7ab69426e7ecbd18a222ee2ec87ca612d30197d7",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            },
            {
              "lessThan": "01bb4045d2306c266178f49ce0c3576d237a3040",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            },
            {
              "lessThan": "91649c02c1baaa18cedf7fb425fa1f0f852c8183",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            },
            {
              "lessThan": "c8ff0ca6508535bccabd81c5c9dcc63de8a3d4fb",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            },
            {
              "lessThan": "fa14e0e19820b1bbdb42185c9c4efa950bcffef9",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            },
            {
              "lessThan": "ec17efb1ef91506cfd17a77692eaf4bbacb520ea",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            },
            {
              "lessThan": "d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7",
              "status": "affected",
              "version": "2b64d153a0cc9d2b60e47be013cde8490f16e0a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: force responder MITM requirements before building the pairing response\n\nsmp_cmd_pairing_req() currently builds the pairing response from the\ninitiator auth_req before enforcing the local BT_SECURITY_HIGH\nrequirement. If the initiator omits SMP_AUTH_MITM, the response can\nalso omit it even though the local side still requires MITM.\n\ntk_request() then sees an auth value without SMP_AUTH_MITM and may\nselect JUST_CFM, making method selection inconsistent with the pairing\npolicy the responder already enforces.\n\nWhen the local side requires HIGH security, first verify that MITM can\nbe achieved from the IO capabilities and then force SMP_AUTH_MITM in the\nresponse in both rsp.auth_req and auth. This keeps the responder auth bits\nand later method selection aligned."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable SMP pairing responder path is reached by Bluetooth LE SMP packets from a nearby Bluetooth peer over the fixed L2CAP SMP channel, so exploitation requires adjacent radio proximity rather than IP network or local system access.\nAC:L - An attacker controls the pairing request authentication bits and IO capability fields needed to trigger the mismatch; no race, heap shaping, or condition outside the attacker\u2019s practical control is required beyond the target requiring high Bluetooth security.\nPR:N - The pairing request is processed pre-authentication and is allowed to create the SMP context, so the adjacent attacker needs no existing pairing, credentials, or local privileges.\nUI:N - The vulnerable policy decision is made during the protocol handshake initiated by the remote Bluetooth peer; in reasonable headless or auto-pairing deployments no specific victim user action is required.\nS:U - The bug bypasses Bluetooth security policy enforced by the same kernel/host Bluetooth security authority and does not cross a VM, IOMMU, or comparable scope boundary.\nC:H - By omitting MITM while the responder requires high security, an adjacent attacker can downgrade protected pairing and expose traffic or keys for services that expected authenticated Bluetooth security, giving access to sensitive protected data.\nI:H - The same downgrade can allow an attacker to inject or alter traffic on Bluetooth services that require authenticated pairing, including high-impact embedded or control deployments.\nA:H - With access to a high-security Bluetooth control channel, an attacker can plausibly disrupt protected device or service operation in embedded, industrial, automotive, or IoT deployments, producing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:18.528Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/425a22c5373d4e1b46492ab869074ebeeade61f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ab69426e7ecbd18a222ee2ec87ca612d30197d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/01bb4045d2306c266178f49ce0c3576d237a3040"
        },
        {
          "url": "https://git.kernel.org/stable/c/91649c02c1baaa18cedf7fb425fa1f0f852c8183"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8ff0ca6508535bccabd81c5c9dcc63de8a3d4fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa14e0e19820b1bbdb42185c9c4efa950bcffef9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec17efb1ef91506cfd17a77692eaf4bbacb520ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7"
        }
      ],
      "title": "Bluetooth: SMP: force responder MITM requirements before building the pairing response",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43334",
    "datePublished": "2026-05-08T13:31:20.923Z",
    "dateReserved": "2026-05-01T14:12:56.002Z",
    "dateUpdated": "2026-08-05T12:27:18.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/virtio_bt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4236e55b2d9d1ffd3b4bdf8ebbb86e5a0a526b4a",
              "status": "affected",
              "version": "cf2719a21fdb9d4c8e9c834d279163609bef575d",
              "versionType": "git"
            },
            {
              "lessThan": "fd91fa2678ab603dfb285416c1cf3843d7be1e41",
              "status": "affected",
              "version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
              "versionType": "git"
            },
            {
              "lessThan": "ed41c81d30b211a671667259c3b5feeba0e062d5",
              "status": "affected",
              "version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
              "versionType": "git"
            },
            {
              "lessThan": "6c1730099a6fc18b183bd6c1adad3b54adcaeda9",
              "status": "affected",
              "version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
              "versionType": "git"
            },
            {
              "lessThan": "b40cdd1b1370d76e9e760af4490cb4a351cceead",
              "status": "affected",
              "version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
              "versionType": "git"
            },
            {
              "lessThan": "e6b4296f170d949ebba937cf6a3f247ec9550d2c",
              "status": "affected",
              "version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
              "versionType": "git"
            },
            {
              "lessThan": "21bd244b6de5d2fe1063c23acc93fbdd2b20d112",
              "status": "affected",
              "version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b67438e315b925a699f0178f4a48baf3d2d6ef4",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.209",
              "status": "affected",
              "version": "5.15.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/virtio_bt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.15.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: virtio_bt: clamp rx length before skb_put\n\nvirtbt_rx_work() calls skb_put(skb, len) where len comes directly\nfrom virtqueue_get_buf() with no validation against the buffer we\nposted to the device. The RX skb is allocated in virtbt_add_inbuf()\nand exposed to virtio as exactly 1000 bytes via sg_init_one().\n\nChecking len against skb_tailroom(skb) is not sufficient because\nalloc_skb() can leave more tailroom than the 1000 bytes actually\nhanded to the device. A malicious or buggy backend can therefore\nreport used.len between 1001 and skb_tailroom(skb), causing skb_put()\nto include uninitialized kernel heap bytes that were never written by\nthe device.\n\nThe same path also accepts len == 0, in which case skb_put(skb, 0)\nleaves the skb empty but virtbt_rx_handle() still reads the pkt_type\nbyte from skb-\u003edata, consuming uninitialized memory.\n\nDefine VIRTBT_RX_BUF_SIZE once and reuse it in alloc_skb() and\nsg_init_one(), and gate virtbt_rx_work() on that same constant so\nthe bound checked matches the buffer actually exposed to the device.\nReject used.len == 0 in the same gate so an empty completion can\nno longer reach virtbt_rx_handle().\n\nUse bt_dev_err_ratelimited() because the length value comes from an\nuntrusted backend that can otherwise flood the kernel log.\n\nSame class of bug as commit c04db81cd028 (\"net/9p: Fix buffer\noverflow in USB transport layer\"), which hardened the USB 9p\ntransport against unchecked device-reported length."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malicious value is the virtqueue used-buffer length supplied by the local virtio backend (host VMM / device-emulation process), reached over the virtio bus rather than the network stack or physical contact; virtio_bt exists only as a paravirtualized transport inside VM guests.\nAC:L - The backend fully and deterministically controls the reported `len`; choosing a value above tailroom reliably panics the guest and a value in (1000, tailroom] reliably exposes uninitialized heap, with no uncontrolled conditions.\nPR:N - The attacking device backend authenticates nothing and holds no privileges within the victim guest kernel, exactly as malicious-peripheral (USB) device bugs are scored PR:N in this tree.\nUI:N - The backend autonomously posts a crafted RX completion as soon as the device is opened; no guest-side user action is required.\nS:U - Both the vulnerable component and the impacted resources (guest kernel heap disclosure and guest kernel panic) reside within the guest kernel\u0027s security authority, so no scope boundary is crossed by the impact.\nC:H - An oversized `len` causes ~700 bytes of uninitialized kernel heap to be injected into the HCI receive path (observable via HCI monitor/raw sockets); this is an unbounded info leak, well beyond a few bytes.\nI:N - The bug only advances skb length/tail pointers and never grants an out-of-bounds write, UAF, or other primitive to modify kernel data beyond what a device can already do legitimately.\nA:H - A `len` exceeding skb tailroom drives `skb_put()` into `skb_over_panic()` \u2192 `BUG()`, giving the backend a reliable, repeatable guest kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:52.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4236e55b2d9d1ffd3b4bdf8ebbb86e5a0a526b4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd91fa2678ab603dfb285416c1cf3843d7be1e41"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed41c81d30b211a671667259c3b5feeba0e062d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c1730099a6fc18b183bd6c1adad3b54adcaeda9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b40cdd1b1370d76e9e760af4490cb4a351cceead"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6b4296f170d949ebba937cf6a3f247ec9550d2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/21bd244b6de5d2fe1063c23acc93fbdd2b20d112"
        }
      ],
      "title": "Bluetooth: virtio_bt: clamp rx length before skb_put",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46123",
    "datePublished": "2026-05-28T09:35:38.003Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-08-05T12:29:52.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/bluetooth.h",
            "net/bluetooth/af_bluetooth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d9ce4de05df2385c19e2c7d12f529144e1a44af1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "41c8c1c7923e86e0eb59cfb4279349112756a336",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4ec17782fd186f901a7329605d11048b085b945a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "be43e6b4043113c3b3cf887c3c8350f67140274c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "85f8674cae82053f1e6bab295f6a8422cca14db5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8b4c412e001b0c670eb937beab491af974da55b3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a218bf69eb51fefe59a3976fa8925261141f681c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e83f5e24da741fa9405aeeff00b08c5ee7c37b88",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/bluetooth.h",
            "net/bluetooth/af_bluetooth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: serialize accept_q access\n\nbt_sock_poll() walks the accept queue without synchronization, while\nchild teardown can unlink the same socket and drop its last reference.\nThe unsynchronized accept queue walk has existed since the initial\nBluetooth import.\n\nProtect accept_q with a dedicated lock for queue updates and polling.\nAlso rework bt_accept_dequeue() to take temporary child references under\nthe queue lock before dropping it and locking the child socket."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable accept queue is in the Bluetooth socket stack and is reachable through nearby Bluetooth peers opening and tearing down L2CAP/RFCOMM-style connections to a listening Bluetooth service.\nAC:L - The race can be exercised repeatedly by driving connection and disconnection activity while the listener polls/accepts, and no rare kernel configuration or condition outside the attacker\u2019s reasonable influence is required.\nPR:N - An adjacent Bluetooth peer can reach the incoming connection and teardown paths without local system privileges or prior authenticated application access in low-security/default Bluetooth service scenarios.\nUI:N - No victim user action is required once the Bluetooth service/socket is listening; the attacker can initiate the relevant Bluetooth protocol traffic.\nS:U - The bug affects kernel Bluetooth socket state within the same host security authority and does not cross a VM, IOMMU, or similar security boundary.\nC:H - The bug is a use-after-free/unsynchronized traversal of freed socket objects; under the required conservative scoring rule, UAF exposure is treated as potentially enabling high-impact kernel information disclosure.\nI:H - The fixed code also pins children during dequeue to prevent references to freed objects, and UAF/refcount operations on reclaimed kernel memory are conservatively treated as potentially enabling memory corruption or control-flow compromise.\nA:H - A failed race or invalid traversal can dereference freed or attacker-influenced kernel memory, producing a kernel oops/panic or repeated Bluetooth service/kernel disruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:40.163Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d9ce4de05df2385c19e2c7d12f529144e1a44af1"
        },
        {
          "url": "https://git.kernel.org/stable/c/41c8c1c7923e86e0eb59cfb4279349112756a336"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ec17782fd186f901a7329605d11048b085b945a"
        },
        {
          "url": "https://git.kernel.org/stable/c/be43e6b4043113c3b3cf887c3c8350f67140274c"
        },
        {
          "url": "https://git.kernel.org/stable/c/85f8674cae82053f1e6bab295f6a8422cca14db5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b4c412e001b0c670eb937beab491af974da55b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a218bf69eb51fefe59a3976fa8925261141f681c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e83f5e24da741fa9405aeeff00b08c5ee7c37b88"
        }
      ],
      "title": "Bluetooth: serialize accept_q access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52918",
    "datePublished": "2026-06-24T07:14:14.539Z",
    "dateReserved": "2026-06-09T07:44:35.367Z",
    "dateUpdated": "2026-08-05T12:31:40.163Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/af_qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2aa4c12723fe432e623462a3be42a197a128722b",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "03bfa95e452e2b6ccd76a332060ae4feaf5ad84d",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "474293d90880622fde9d2430fb0165767090f7b3",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "2047c2aa0963bb2872fd722300a15bcb441a4c00",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "7de2d447072be3b1a76793f034432338fc9c494b",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "ab269990ed58143a92a263be1bee626d82ac03da",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "3b20ec8f31e8a6a6782243f473b0abd3463621df",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            },
            {
              "lessThan": "a2171131ecda1ed61a594a1eb715e75fdad0fef5",
              "status": "affected",
              "version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/af_qrtr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n  refcount_t: saturated; leaking memory.\n  WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n  Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n  Call Trace:\n   \u003cTASK\u003e\n   qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n   __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n   qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n   kernel_bind+0xe4/0x120 net/socket.c:3592\n   qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n   qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n   do_one_initcall+0xf5/0x5e0 init/main.c:1283\n   ...\n   \u003c/TASK\u003e\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reachable through local AF_QIPCRTR datagram sockets via bind/autobind, sendmsg lookup, rebind, and close/release; QRTR transports are local IPC/internal device transports rather than Internet-facing network services. A local unprivileged process on a QRTR-enabled system can create and race these sockets.\nAC:L - Although this is a race, the attacker can control both sides by repeatedly removing bound QRTR ports while concurrently causing QRTR port lookups through local sends or other QRTR activity. Syzkaller reached the race, and there are no special external conditions beyond attacker-driven concurrency.\nPR:L - Creating AF_QIPCRTR sockets and binding ephemeral or high-numbered QRTR ports does not require CAP_NET_ADMIN or root. Control-port binding has extra checks, but exploitation does not depend on becoming the controller.\nUI:N - No victim action is required once the attacker has local code execution. The attacker can create sockets, bind/send/close them, and run the race directly.\nS:U - The corruption is within the kernel networking/QRTR subsystem and does not cross a separate security authority such as a VM, IOMMU, or sandbox boundary. A local kernel compromise remains unchanged scope.\nC:H - The bug is a potential use-after-free of a QRTR socket object reachable through stale XArray/RCU lookups and refcount resurrection. Per kernel scoring guidance, UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A UAF on a kernel socket object can potentially be shaped with heap spraying into write or control-flow primitives. When uncertain, this should be scored as high integrity impact rather than only a crash.\nA:H - The observed failure is a refcount saturation warning on a stale socket reference, and the underlying UAF can lead to kernel oops, panic, or memory corruption. This is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:58.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b"
        },
        {
          "url": "https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d"
        },
        {
          "url": "https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00"
        },
        {
          "url": "https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5"
        }
      ],
      "title": "net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52947",
    "datePublished": "2026-06-24T16:26:05.062Z",
    "dateReserved": "2026-06-09T07:44:35.371Z",
    "dateUpdated": "2026-08-05T12:31:58.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            },
            {
              "lessThan": "9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            },
            {
              "lessThan": "c7777f534a8018ae4bb1c80d8925af4df588a314",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            },
            {
              "lessThan": "6b4d226d01ab7da0d2027a2a1e3a6079152e5065",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            },
            {
              "lessThan": "541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            },
            {
              "lessThan": "385b2d0468a0871fc716c549fa3b0c257c7dbcb3",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            },
            {
              "lessThan": "c27224daf0b08efbb2b24ed64b6139b294f5473a",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            },
            {
              "lessThan": "5c7209a341ff2ac338b2b0375c34a307b37c9ac2",
              "status": "affected",
              "version": "70c464256310e1c3716099b9d02ece4169272f73",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER\n\nWhen protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls\nhci_connect_cfm(conn) without hdev-\u003elock. Generally hci_connect_cfm()\nassumes it is held, and if conn is deleted concurrently -\u003e UAF.\n\nOnly SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,\nand HCI_EV_CONN_REQUEST is not generated for ISO.  In the non-deferred\nlistening socket code paths, hci_connect_cfm(conn) is called with\nhdev-\u003elock held.\n\nFix by holding the lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is reached through Bluetooth HCI connection request handling for incoming SCO/eSCO connections from a nearby Bluetooth peer, so exploitation requires adjacency to the target Bluetooth radio.\nAC:L - The attacker can repeatedly initiate deferred SCO/eSCO connection attempts and race connection teardown/cleanup; when uncertain for this race, the higher-severity low-complexity rating is appropriate.\nPR:N - The remote Bluetooth peer reaches the pre-authentication connection request path without local privileges or verified credentials; local deferred-listener configuration is an environmental precondition, not attacker privilege.\nUI:N - Once the target has a deferred SCO/eSCO listener, the attacker can trigger the vulnerable HCI event without requiring a victim to perform an action.\nS:U - The bug is in the kernel Bluetooth stack and impacts the same kernel security authority; it is not a VM, sandbox, or hardware boundary escape by itself.\nC:H - The flaw is a use-after-free of an hci_conn object, and kernel heap UAFs can be leveraged for memory disclosure primitives in a plausible exploitation scenario.\nI:H - The freed hci_conn contains pointers, callback state, and protocol data used by confirmation callbacks, making control-flow or arbitrary memory corruption a defensible high-integrity impact for a kernel UAF.\nA:H - Even without full exploitation, dereferencing a concurrently freed hci_conn can crash or destabilize the kernel, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:06.917Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065"
        },
        {
          "url": "https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f"
        },
        {
          "url": "https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2"
        }
      ],
      "title": "Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53072",
    "datePublished": "2026-06-24T16:30:13.570Z",
    "dateReserved": "2026-06-09T07:44:35.383Z",
    "dateUpdated": "2026-08-05T12:33:06.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.53.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.162.1.rt7.503.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.162.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s handling of Generic Segmentation Offload (GSO) packet headers. This vulnerability occurs when the `qdisc_pkt_len_segs_init()` function does not properly pull headers into the expected memory location, which can lead to incorrect processing by network drivers. A remote attacker could exploit this by sending specially crafted malicious packets, potentially causing a denial of service (DoS) or other unexpected system behavior."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-131",
                "description": "Incorrect Calculation of Buffer Size",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T12:04:34.429Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53091"
          },
          {
            "name": "RHBZ#2492270",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492270"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65334"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67150"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66325"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66324"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:65334: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67150: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66325: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66324: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: net: pull headers in qdisc_pkt_len_segs_init()",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/dropreason-core.h",
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a",
              "status": "affected",
              "version": "e876f208af18b074f800656e4d1b99da75b2135f",
              "versionType": "git"
            },
            {
              "lessThan": "7fb4c19670110f052c04e1ec1d2b953b9f4f57e4",
              "status": "affected",
              "version": "e876f208af18b074f800656e4d1b99da75b2135f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/dropreason-core.h",
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pull headers in qdisc_pkt_len_segs_init()\n\nMost ndo_start_xmit() methods expects headers of gso packets\nto be already in skb-\u003ehead.\n\nnet/core/tso.c users are particularly at risk, because tso_build_hdr()\ndoes a memcpy(hdr, skb-\u003edata, hdr_len);\n\nqdisc_pkt_len_segs_init() already does a dissection of gso packets.\n\nUse pskb_may_pull() instead of skb_header_pointer() to make\nsure drivers do not have to reimplement this.\n\nSome malicious packets could be fed, detect them so that we can\ndrop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local transmit paths such as AF_PACKET, TUN/TAP, or guest virtio/tap injection where an attacker can supply GSO metadata. Ordinary remote packets do not carry this malformed skb/GSO state on the wire.\nAC:L - No race or external timing condition is required. The attacker controls the GSO header metadata and packet layout needed to make qdisc accept a header that later TX code expects to be linear.\nPR:L - AF_PACKET requires CAP_NET_RAW in the target network namespace, and TUN/TAP style paths require CAP_NET_ADMIN or access to an existing tap/tun file descriptor. These are reachable as low privilege in user-namespace or guest/tap deployments rather than requiring init-namespace root in the highest reasonable scenario.\nUI:N - No victim user action is needed once the attacker can inject the crafted local/guest packet. The transmit path processes the skb automatically.\nS:C - In virtualization deployments, a guest-controlled GSO packet can be processed by the host kernel tap/vhost transmit path and affect host kernel memory or availability. That crosses the guest-to-host security boundary.\nC:H - TSO helpers copy header bytes directly from skb-\u003edata, so a header accepted via skb_header_pointer() but not pulled into skb-\u003ehead can leak adjacent kernel memory into transmitted segment headers. This is an out-of-bounds kernel read and is scored High.\nI:N - The investigated primitive is incorrect header linearity causing out-of-bounds reads and crashes, not a demonstrated attacker-controlled write or protected data modification. I did not find a reliable integrity-impacting write primitive from this fix.\nA:H - Malformed GSO packets can trigger kernel faults or invalid driver/TSO behavior during transmit, including panics reported for this issue. Repeated local injection can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:18.759Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"
        }
      ],
      "title": "net: pull headers in qdisc_pkt_len_segs_init()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53091",
    "datePublished": "2026-06-24T16:30:30.290Z",
    "dateReserved": "2026-06-09T07:44:35.384Z",
    "dateUpdated": "2026-09-14T12:04:34.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc0ec2fc02dfe52c5821f36fbccf6a45df43f508",
              "status": "affected",
              "version": "56189d7bc30531def6b999f27940ee43c6ff2569",
              "versionType": "git"
            },
            {
              "lessThan": "688fcac7054abc680c0eef753f2bb772cfaf8cf7",
              "status": "affected",
              "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
              "versionType": "git"
            },
            {
              "lessThan": "30c3fa80f423613efdda3deca4af52ff7d20e4e2",
              "status": "affected",
              "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
              "versionType": "git"
            },
            {
              "lessThan": "265c07c09c837621730d35f02975207a1224bf05",
              "status": "affected",
              "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
              "versionType": "git"
            },
            {
              "lessThan": "ecbf3c45add30a0857414e156bdb9c79906f0ff6",
              "status": "affected",
              "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
              "versionType": "git"
            },
            {
              "lessThan": "4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1",
              "status": "affected",
              "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.160",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.160",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject oversized EMA RNR lists\n\nnl80211_parse_rnr_elems() stores the parsed element count in a\nu8-backed cfg80211_rnr_elems::cnt field and uses that count to size\nthe flexible array allocation.\n\nReject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches\n255, before incrementing it again. This keeps the parser aligned with\nthe data structure it fills and matches the existing bound check used\nby nl80211_parse_mbssid_elems()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable parser is reached through local nl80211 generic-netlink commands that configure AP beacon data, not by received WiFi frames or remote network traffic.\nAC:L - An attacker who can send the command can deterministically provide 256 or more nested EMA RNR elements; there is no race or condition outside the attacker\u0027s control beyond targeting an affected AP-capable configuration.\nPR:L - The commands require CAP_NET_ADMIN via GENL_UNS_ADMIN_PERM, which is checked in the relevant network namespace; under kernel scoring guidance this is low privilege because CAP_NET_ADMIN may be available through user namespaces.\nUI:N - No victim action is required after the attacker sends the crafted nl80211 request.\nS:U - The corruption occurs inside the kernel and impacts the same kernel security authority; it is not a VM escape or other cross-scope boundary violation.\nC:H - The u8 count wrap causes an undersized flexible-array allocation followed by attacker-influenced out-of-bounds heap writes, which is memory corruption plausibly usable for kernel memory disclosure.\nI:H - The bug is a kernel heap out-of-bounds write of RNR element metadata past the allocation, making arbitrary corruption or control-flow compromise defensible.\nA:H - The same heap corruption can readily crash or panic the kernel even if not weaponized for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:48.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc0ec2fc02dfe52c5821f36fbccf6a45df43f508"
        },
        {
          "url": "https://git.kernel.org/stable/c/688fcac7054abc680c0eef753f2bb772cfaf8cf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/30c3fa80f423613efdda3deca4af52ff7d20e4e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/265c07c09c837621730d35f02975207a1224bf05"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecbf3c45add30a0857414e156bdb9c79906f0ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1"
        }
      ],
      "title": "wifi: nl80211: reject oversized EMA RNR lists",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53182",
    "datePublished": "2026-06-25T08:38:56.654Z",
    "dateReserved": "2026-06-09T07:44:35.390Z",
    "dateUpdated": "2026-08-05T12:33:48.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10b0e832cc05d7aef4b92bed912cbd4a395d0862",
              "status": "affected",
              "version": "63f365eb4d1668a04070151b555d55a07ede8d4b",
              "versionType": "git"
            },
            {
              "lessThan": "1338ee049a8910ba6c9cee963920e978e6893c7d",
              "status": "affected",
              "version": "c621211b308816889f0a3246de448bfcef8ab3ab",
              "versionType": "git"
            },
            {
              "lessThan": "02f50e8bb69f9b22516163a09922f5537d3b12d1",
              "status": "affected",
              "version": "907ef6e12fb558a0763e894311eb245a94c192dd",
              "versionType": "git"
            },
            {
              "lessThan": "dafc9f57140e66a10945127aa7433c3d715dc253",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "lessThan": "cdd8bbdbee763fdf5bf343e6f7d4e79347739f62",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "lessThan": "5c65b96b549ea2dcfde497436bf9e048deb87758",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "15da883c010cbc2a84aec1738b6ad6ee477846de",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.143",
              "status": "affected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.94",
              "status": "affected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.6.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.12.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: reject oversized Broadcast Announcement prepend\n\nExisting advertising instances can already hold the maximum extended\nadvertising payload. When hci_adv_bcast_annoucement() prepends the\nBroadcast Announcement service data to that payload, the combined data\nmay no longer fit in the temporary buffer used to rebuild the\nadvertising data.\n\nReject that case before copying the existing payload and report the\nfailure through the device log. This keeps the existing advertising\ndata intact and avoids overrunning the temporary buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local AF_BLUETOOTH HCI management/ISO socket operations that configure advertising data and start BIS/periodic advertising. It is not reachable directly from Bluetooth radio packets sent by an adjacent attacker.\nAC:L - The attacker can choose the advertising payload length/content, omit an existing Broadcast Announcement, provide BASE data that creates Basic Audio Announcement periodic data, and trigger the prepend deterministically. The needed Bluetooth LE Audio/extended advertising support is a reasonable affected deployment condition.\nPR:L - The advertising setup path requires a trusted HCI management socket via CAP_NET_ADMIN, but the code uses capable() and is therefore reachable by a basic local user with CAP_NET_ADMIN obtained in a user namespace on systems allowing unprivileged user namespaces. ISO socket triggering itself has no stronger privilege gate.\nUI:N - No victim action is required once the local attacker can issue the Bluetooth socket operations. The attacker performs both setup and trigger steps directly.\nS:U - The corruption occurs in kernel Bluetooth code and affects the same kernel security authority. This is a standard local kernel memory-corruption scenario, not a VM/IOMMU or other cross-scope boundary escape.\nC:H - The bug is an attacker-controlled kernel stack out-of-bounds write, and such memory corruption can plausibly be leveraged beyond a simple crash in less hardened configurations. Under the required uncertainty rule, confidentiality impact is scored high.\nI:H - The vulnerable memcpy writes past a fixed 251-byte stack buffer with attacker-controlled advertising bytes. Out-of-bounds kernel writes are scored as high integrity impact because they may enable control-flow or data corruption.\nA:H - At minimum, the overflow can corrupt stack state or trigger hardening checks such as stack protector/FORTIFY, causing an oops or panic. The attacker can repeat the local trigger to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:09.314Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10b0e832cc05d7aef4b92bed912cbd4a395d0862"
        },
        {
          "url": "https://git.kernel.org/stable/c/1338ee049a8910ba6c9cee963920e978e6893c7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/02f50e8bb69f9b22516163a09922f5537d3b12d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dafc9f57140e66a10945127aa7433c3d715dc253"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdd8bbdbee763fdf5bf343e6f7d4e79347739f62"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c65b96b549ea2dcfde497436bf9e048deb87758"
        }
      ],
      "title": "Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53209",
    "datePublished": "2026-06-25T08:39:14.915Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:09.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}