Vulnerability-Lookup

RHSA-2026:66180

Vulnerability from csaf_redhat - Published: 2026-09-10 00:39 - Updated: 2026-09-15 01:12

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275) * kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) Bug Fix(es) and Enhancement(s): * KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:RHEL-249161) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-43133

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) nSVM module. When a nested virtual machine (L2 guest) executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor (L1), KVM incorrectly uses `vmcb02` instead of `vmcb01` for managing guest state. This incorrect Virtual Machine Control Block (VMCB) handling could lead to unexpected behavior or state corruption within the virtualized environment.

7.9 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

CWE-628 - Function Call with Incorrectly Specified Arguments

Affected products

Fixed 303 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-687.46.1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.46.1.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-687.46.1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-uki-virt-addons-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.46.1.el9_8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-43339

A flaw was found in the Linux kernel's IPv6 networking subsystem. Specifically, a Use-after-Free (UaF) vulnerability exists within the `addrconf_permanent_addr()` function. This issue arises when the system attempts to access an IPv6 address after it has been freed, which could allow an attacker to cause a denial of service or potentially execute arbitrary code.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-43493

A flaw was found in the Linux kernel's `pcrypt` component. This vulnerability involves how the system handles certain requests, specifically `MAY_BACKLOG` requests, which can indicate a temporary busy state. If not properly managed, the system's processing of these requests could lead to resource exhaustion or instability.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-46015

A flaw was found in the Linux kernel's TCP networking subsystem. When an established network connection is migrated between listener sockets within the same SO_REUSEPORT group, applications waiting for new connections may not be properly notified. This can cause poll(), epoll_wait(), and blocking accept() calls to remain unresponsive indefinitely, leading to a Denial of Service (DoS) for affected applications.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-821 - Incorrect Synchronization

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-46149

A flaw was found in the Linux kernel's SCSI target subsystem. This vulnerability, a buffer overflow, occurs in the `tg_pt_gp_members_show()` function when processing long iSCSI IQN names. An attacker could potentially exploit this by providing a specially crafted input, leading to the disclosure of sensitive information from the kernel stack or a denial of service (DoS) if `CONFIG_FORTIFY_SOURCE` is enabled.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-46266

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTO_RAW. A remote attacker could send a specially crafted ICMP (Internet Control Message Protocol) packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for IPPROTO_RAW. This leads to unintended FNHE (Flow N-tuple Hash Entry) cache changes, which could result in unexpected network behavior.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1287 - Improper Validation of Specified Type of Input

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-46306

A flaw was found in the Linux kernel's flow dissector. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted Point-to-Point Protocol over Ethernet (PPPoE) Protocol Field Compression (PFC) frame to an affected system. The incorrect processing of these compressed frames leads to a memory misalignment, which can result in a kernel crash on certain architectures.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-46330

A flaw was found in the Linux kernel's TCP User-Level Protocol (ULP) support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System (VFS) structures in-place. This action violates fundamental VFS invariants, leading to a risk of use-after-free errors and general system instability.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-53002

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of `sprintf` and insufficient buffer sizing in the `mangle_content_len()` function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue to cause a denial of service or other unspecified impacts.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Important

CVE-2026-53223

A flaw was found in the Linux kernel's networking component. This vulnerability allows a remote attacker to potentially access sensitive information or cause system instability. By sending specially crafted network packets, an attacker can exploit an issue in how the kernel handles timestamping for certain network traffic. This can lead to the disclosure of memory contents or trigger memory corruption.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-53275

A flaw was found in the Linux kernel's IPv6 multicast (mcast) component. When processing Multicast Listener Discovery (MLD) queries, a pointer to the multicast group address is not correctly reloaded after certain packet manipulations. This can lead to a use-after-free vulnerability, potentially allowing an attacker to cause a denial of service or achieve arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-53366

A flaw was found in the Linux kernel's handling of IPv4 network packets. An error in how the kernel accounts for fragmented data during memory allocation can lead to an undersized memory buffer. This memory handling issue could potentially be exploited by a remote attacker to cause a system crash or denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Important

CVE-2026-64034

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use (TOCTOU) vulnerability allows a hardware component to modify a message identifier (hwc_msg_id) in Direct Memory Access (DMA) memory after it has been validated but before it is used. This manipulation bypasses critical bounds validation, potentially leading to unexpected system behavior or security bypasses, particularly in Confidential Virtual Machines (CVMs) where DMA memory is shared and unencrypted.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Moderate

CVE-2026-64563

A flaw was found in the Linux kernel. This vulnerability, known as a use-after-free, occurs in the `rhashtable` component when the system improperly handles hash table restarts. An attacker could potentially exploit this by causing the system to access memory that has already been released, which may lead to a system crash (Denial of Service) or, in more severe scenarios, allow for unauthorized code execution or information disclosure.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Important

CVE-2026-64597

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A vulnerability exists in the SMB2_close() replay mechanism where a response buffer can be freed twice. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of arbitrary code.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-415 - Double Free

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Important

CVE-2026-72129

A flaw was found in the `nvmet-rdma` component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially resulting in an out-of-bounds read. This could lead to a denial of service or the disclosure of sensitive information.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Important

CVE-2026-74480

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a stale pointer. This memory corruption vulnerability could lead to system instability or a denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-43133

Threats

Impact Important

References

105 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:66180	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467065	external
https://bugzilla.redhat.com/show_bug.cgi?id=2468102	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479812	external
https://bugzilla.redhat.com/show_bug.cgi?id=2481936	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482566	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484456	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486463	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486999	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492329	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492811	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492841	external
https://bugzilla.redhat.com/show_bug.cgi?id=2501252	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502394	external
https://bugzilla.redhat.com/show_bug.cgi?id=2510892	external
https://bugzilla.redhat.com/show_bug.cgi?id=2511932	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516731	external
https://bugzilla.redhat.com/show_bug.cgi?id=2517046	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-43133	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467065	external
https://www.cve.org/CVERecord?id=CVE-2026-43133	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43133	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43339	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468102	external
https://www.cve.org/CVERecord?id=CVE-2026-43339	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43339	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-43493	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479812	external
https://www.cve.org/CVERecord?id=CVE-2026-43493	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43493	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-46015	self
https://bugzilla.redhat.com/show_bug.cgi?id=2481936	external
https://www.cve.org/CVERecord?id=CVE-2026-46015	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46015	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46149	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482566	external
https://www.cve.org/CVERecord?id=CVE-2026-46149	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46149	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46266	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484456	external
https://www.cve.org/CVERecord?id=CVE-2026-46266	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46266	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-46306	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486463	external
https://www.cve.org/CVERecord?id=CVE-2026-46306	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46306	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-46330	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486999	external
https://www.cve.org/CVERecord?id=CVE-2026-46330	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46330	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53002	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492329	external
https://www.cve.org/CVERecord?id=CVE-2026-53002	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53002	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53223	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492811	external
https://www.cve.org/CVERecord?id=CVE-2026-53223	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53223	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53275	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492841	external
https://www.cve.org/CVERecord?id=CVE-2026-53275	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53275	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53366	self
https://bugzilla.redhat.com/show_bug.cgi?id=2501252	external
https://www.cve.org/CVERecord?id=CVE-2026-53366	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53366	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64034	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502394	external
https://www.cve.org/CVERecord?id=CVE-2026-64034	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64034	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64563	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510892	external
https://www.cve.org/CVERecord?id=CVE-2026-64563	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64563	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-64597	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511932	external
https://www.cve.org/CVERecord?id=CVE-2026-64597	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64597	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72129	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516731	external
https://www.cve.org/CVERecord?id=CVE-2026-72129	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72129	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-74480	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517046	external
https://www.cve.org/CVERecord?id=CVE-2026-74480	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74480	external
https://lore.kernel.org/linux-cve-announce/202608…	external

JSON

To clipboard

Loading 1.9 MB of JSON…

CVE-2026-43133 (GCVE-0-2026-43133)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-09-10 12:04

Title

KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01. As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.

Severity

7.9 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

CWE

CWE-628 - Function Call with Incorrectly Specified Arguments

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/10063e1251c148503…
https://git.kernel.org/stable/c/c3b7015000988ba35…
https://git.kernel.org/stable/c/3880e331b0b31d0d5…
https://git.kernel.org/stable/c/fce2fd4a2ca05670a…
https://git.kernel.org/stable/c/d464cf1ed900d47c8…
https://git.kernel.org/stable/c/0004ecb798b30e90d…
https://git.kernel.org/stable/c/127ccae2c185f62e6…
https://access.redhat.com/security/cve/CVE-2026-43133	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467065	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:65334	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66180	vendor-advisoryx_refsource_REDHAT

Impacted products

10 products

Vendor	Product	Version
Linux	Linux	Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < 10063e1251c1485034a018236080792ad083dcc5 (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < c3b7015000988ba35ecd5648f4b2283960f00543 (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < 3880e331b0b31d0d5d3702b124f6c93539cd478a (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < fce2fd4a2ca05670a91015aacccf96a1c26268fd (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < d464cf1ed900d47c85393d40b00017b6adfc2e6c (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < 0004ecb798b30e90d7ebfe74efae2d9423315a64 (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619 (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.53.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.46.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.53.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.46.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-06T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) nSVM module. When a nested virtual machine (L2 guest) executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor (L1), KVM incorrectly uses `vmcb02` instead of `vmcb01` for managing guest state. This incorrect Virtual Machine Control Block (VMCB) handling could lead to unexpected behavior or state corruption within the virtualized environment."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.9,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-628",
                "description": "Function Call with Incorrectly Specified Arguments",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T12:04:52.427Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43133"
          },
          {
            "name": "RHBZ#2467065",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65334"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66180"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:65334: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66180: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10063e1251c1485034a018236080792ad083dcc5",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "c3b7015000988ba35ecd5648f4b2283960f00543",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "3880e331b0b31d0d5d3702b124f6c93539cd478a",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "fce2fd4a2ca05670a91015aacccf96a1c26268fd",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "d464cf1ed900d47c85393d40b00017b6adfc2e6c",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "0004ecb798b30e90d7ebfe74efae2d9423315a64",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            },
            {
              "lessThan": "127ccae2c185f62e6ecb4bf24f9cb307e9b9c619",
              "status": "affected",
              "version": "cc3ed80ae69f454c3d904af9f65394a540099723",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by locally running a KVM vCPU through /dev/kvm and executing nested SVM VMLOAD/VMSAVE from an L2 guest; it is not reachable via network packets.\nAC:L - The trigger is deterministic once nested SVM is available: configure L1 not to intercept VMLOAD/VMSAVE and execute the instruction in L2. No race or attacker-uncontrolled timing condition is required.\nPR:L - The attacker needs the ability to create/run a KVM VM or execute code in a nested guest, which is local low privilege where /dev/kvm is delegated. No real init-namespace root capability is required by the vulnerable emulation path itself.\nUI:N - After the VM/nested guest is running, exploitation is triggered solely by guest instruction execution. No additional victim user action is required.\nS:C - The bug is in KVM\u2019s enforcement of the nested virtualization boundary, where L2 execution causes KVM to operate on the wrong L0-maintained VMCB state. That can affect resources outside the L2 guest\u2019s own security authority.\nC:L - VMSAVE can copy bounded VMLOAD/VMSAVE save-state fields from the wrong internal VMCB into guest-accessible memory. I did not identify an arbitrary host-memory read primitive, so the defensible confidentiality impact is limited.\nI:L - VMLOAD can corrupt a bounded set of VMLOAD/VMSAVE state fields in the wrong KVM VMCB, causing incorrect nested guest/L1 state handling. I did not find a direct arbitrary host write or host code execution primitive.\nA:H - The wrong VMCB state can make nested VM execution fail or crash/hang the affected virtual machine/vCPU, and the attacker can trigger it repeatedly. This is a complete availability impact for the affected nested virtualization workload, even though I did not find a host kernel panic path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:09.214Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543"
        },
        {
          "url": "https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64"
        },
        {
          "url": "https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619"
        }
      ],
      "title": "KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43133",
    "datePublished": "2026-05-06T11:27:20.882Z",
    "dateReserved": "2026-05-01T14:12:55.988Z",
    "dateUpdated": "2026-09-10T12:04:52.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43339 (GCVE-0-2026-43339)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:31 – Updated: 2026-08-05 12:27

Title

ipv6: prevent possible UaF in addrconf_permanent_addr()

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible deletion. Reorder the statement to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no protection.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/eec49a33611f20336…
https://git.kernel.org/stable/c/bacc7f31085c98209…
https://git.kernel.org/stable/c/7bfafa1b0cd582983…
https://git.kernel.org/stable/c/7d9f2f4aabd116ca6…
https://git.kernel.org/stable/c/25357b670afb5b517…
https://git.kernel.org/stable/c/3cd4efb5df72843df…
https://git.kernel.org/stable/c/2d88ed7fa000e19c2…
https://git.kernel.org/stable/c/fd63f185979b047fb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < eec49a33611f20336b357b3953df44f1a02049e8 (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < bacc7f31085c9820922f00bc7d79756ffa13123a (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 7bfafa1b0cd582983ebec6bb20f0a435528fe567 (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 25357b670afb5b517096da783abaa5cc4bf8359e (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 3cd4efb5df72843dfac892d0b3c7a4a8bd926b65 (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1 (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 (git)
Linux	Linux	Affected: 4.6 Unaffected: 0 , < 4.6 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eec49a33611f20336b357b3953df44f1a02049e8",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            },
            {
              "lessThan": "bacc7f31085c9820922f00bc7d79756ffa13123a",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            },
            {
              "lessThan": "7bfafa1b0cd582983ebec6bb20f0a435528fe567",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            },
            {
              "lessThan": "7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            },
            {
              "lessThan": "25357b670afb5b517096da783abaa5cc4bf8359e",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            },
            {
              "lessThan": "3cd4efb5df72843dfac892d0b3c7a4a8bd926b65",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            },
            {
              "lessThan": "2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            },
            {
              "lessThan": "fd63f185979b047fb22a0dfc6bd94d0cab6a6a70",
              "status": "affected",
              "version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible UaF in addrconf_permanent_addr()\n\nThe mentioned helper try to warn the user about an exceptional\ncondition, but the message is delivered too late, accessing the ipv6\nafter its possible deletion.\n\nReorder the statement to avoid the possible UaF; while at it, place the\nwarning outside the idev-\u003elock as it needs no protection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local network administration actions such as rtnetlink/sysctl-driven IPv6 address configuration and interface down/up transitions, not by remote packets.\nAC:L - A local attacker who can administer a network namespace can create the retained permanent-address state and repeatedly drive link-up restoration while inducing allocation pressure; there is no victim-controlled race required.\nPR:L - The operations require CAP_NET_ADMIN, but they are checked in the target network namespace and are reachable to an unprivileged local user via user+network namespaces on systems where those are enabled.\nUI:N - No victim user action is needed once the attacker can issue the local namespace/network configuration operations.\nS:U - The impact is within the kernel security authority; this is standard local kernel memory-safety impact rather than a cross-scope boundary such as guest-to-host escape.\nC:H - The bug dereferences a freed inet6_ifaddr and can read freed or reallocated kernel heap contents in the warning path; per the requested UAF guidance, confidentiality is High.\nI:H - Although the immediate dereference is in logging, it is a kernel heap use-after-free and the requested kernel guidance treats UAFs as potentially exploitable through heap reuse/spraying for high integrity impact.\nA:H - The freed object access can trigger a kernel fault, UAF detector report, or crash, and the local trigger can be repeated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:20.671Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eec49a33611f20336b357b3953df44f1a02049e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bacc7f31085c9820922f00bc7d79756ffa13123a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bfafa1b0cd582983ebec6bb20f0a435528fe567"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/25357b670afb5b517096da783abaa5cc4bf8359e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cd4efb5df72843dfac892d0b3c7a4a8bd926b65"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd63f185979b047fb22a0dfc6bd94d0cab6a6a70"
        }
      ],
      "title": "ipv6: prevent possible UaF in addrconf_permanent_addr()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43339",
    "datePublished": "2026-05-08T13:31:24.315Z",
    "dateReserved": "2026-05-01T14:12:56.003Z",
    "dateUpdated": "2026-08-05T12:27:20.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43493 (GCVE-0-2026-43493)

Vulnerability from cvelistv5 – Published: 2026-05-19 10:44 – Updated: 2026-08-05 12:28

Title

crypto: pcrypt - Fix handling of MAY_BACKLOG requests

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ae7e95638d956d556…
https://git.kernel.org/stable/c/1d7f07df450bac330…
https://git.kernel.org/stable/c/76641449b28979ebd…
https://git.kernel.org/stable/c/9f1cbca178c03188e…
https://git.kernel.org/stable/c/eb34e243df57e32f4…
https://git.kernel.org/stable/c/77d55bc8675ee851e…
https://git.kernel.org/stable/c/46271895ddfb1ba41…
https://git.kernel.org/stable/c/915b692e6cb723aac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < ae7e95638d956d556d74b9abb9e780d3bd3dcd9e (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 1d7f07df450bac3301938fbc4251f2611be4084e (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 76641449b28979ebd6c02e9598367e119e385236 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 9f1cbca178c03188e201ed175251372149bb25f2 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < eb34e243df57e32f4c08fa191f3602ea19076276 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 77d55bc8675ee851ed639dc9be77325a8024cf67 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 915b692e6cb723aac658c25eb82c58fd81235110 (git)
Linux	Linux	Affected: 2.6.34 Unaffected: 0 , < 2.6.34 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/pcrypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae7e95638d956d556d74b9abb9e780d3bd3dcd9e",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "1d7f07df450bac3301938fbc4251f2611be4084e",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "76641449b28979ebd6c02e9598367e119e385236",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "9f1cbca178c03188e201ed175251372149bb25f2",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "eb34e243df57e32f4c08fa191f3602ea19076276",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "77d55bc8675ee851ed639dc9be77325a8024cf67",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "915b692e6cb723aac658c25eb82c58fd81235110",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/pcrypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY.  Handle them by checking\nfor that value and filtering out EINPROGRESS notifications."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - pcrypt AEAD can sit under network-facing kernel crypto consumers such as kTLS/TIPC that process peer-supplied records or packets. In the highest reasonable deployment, a remote peer can drive the vulnerable encrypt/decrypt path through network traffic.\nAC:L - The trigger is child crypto backlog behavior under `CRYPTO_TFM_REQ_MAY_BACKLOG`; an attacker can induce queue pressure with concurrent requests or traffic. There is no race that depends on conditions outside the attacker\u0027s control.\nPR:N - The network-facing path requires no kernel privileges from the remote peer. The local AF_ALG AEAD path also has no capability gate, but the higher-severity network scenario is defensible.\nUI:N - No victim interaction is required once the affected crypto consumer is configured. The attacker only sends data or submits crypto requests.\nS:U - The bug corrupts kernel crypto/request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - Mishandling `-EBUSY` can complete and free the request while the child request remains queued, leading to use-after-free on later callbacks. A kernel UAF is reasonably exploitable for high-impact information disclosure.\nI:H - The stale callback reuses freed request/padata memory and can drive list operations and completion paths on attacker-reclaimed objects. This is memory corruption with a plausible path to arbitrary write or control-flow corruption.\nA:H - At minimum, the premature completion and later queued callback can dereference or manipulate freed kernel memory. That can produce kernel oops/panic or list corruption, giving high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:16.602Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e"
        },
        {
          "url": "https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276"
        },
        {
          "url": "https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67"
        },
        {
          "url": "https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a"
        },
        {
          "url": "https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110"
        }
      ],
      "title": "crypto: pcrypt - Fix handling of MAY_BACKLOG requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43493",
    "datePublished": "2026-05-19T10:44:25.402Z",
    "dateReserved": "2026-05-01T14:12:56.013Z",
    "dateUpdated": "2026-08-05T12:28:16.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46015 (GCVE-0-2026-46015)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:56 – Updated: 2026-09-08 08:49

Title

tcp: call sk_data_ready() after listener migration

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener gets a new accept-queue entry via inet_csk_reqsk_queue_add(), but that path never notifies the target listener's waiters. A nonblocking accept() still works because it checks the queue directly, but poll()/epoll_wait() waiters and blocking accept() callers can also remain asleep indefinitely. Call READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration in inet_csk_listen_stop(). However, after inet_csk_reqsk_queue_add() succeeds, the ref acquired in reuseport_migrate_sock() is effectively transferred to nreq->rsk_listener. Another CPU can then dequeue nreq via accept() or listener shutdown, hit reqsk_put(), and drop that listener ref. Since listeners are SOCK_RCU_FREE, wrap the post-queue_add() dereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also covers the existing sock_net(nsk) access in that path. The reqsk_timer_handler() path does not need the same changes for two reasons: half-open requests become readable only after the final ACK, where tcp_child_process() already wakes the listener; and once nreq is visible via inet_ehash_insert(), the success path no longer touches nsk directly.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7aa7933a5607b1e5b…
https://git.kernel.org/stable/c/14e9bb6eba8f59dcc…
https://git.kernel.org/stable/c/ab5fdcd535645f6db…
https://git.kernel.org/stable/c/bebd058ef40c67a81…
https://git.kernel.org/stable/c/83bb57635d7cbafde…
https://git.kernel.org/stable/c/12625b4da84caf4d8…
https://git.kernel.org/stable/c/3864c6ba1e041bc75…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 7aa7933a5607b1e5b56f322d17265c1d0ea02c51 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 14e9bb6eba8f59dcc637702e4744ae5e30660d76 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < bebd058ef40c67a81fe6d9ee8beaa4ede90e0704 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 83bb57635d7cbafde32f865b577ecfd969f02337 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 12625b4da84caf4d84a04988710a7b9bcf702b18 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 3864c6ba1e041bc75342353a70fa2a2c6f909923 (git)
Linux	Linux	Affected: 5.14 Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:01.249Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7aa7933a5607b1e5b56f322d17265c1d0ea02c51",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "14e9bb6eba8f59dcc637702e4744ae5e30660d76",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "bebd058ef40c67a81fe6d9ee8beaa4ede90e0704",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "83bb57635d7cbafde32f865b577ecfd969f02337",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "12625b4da84caf4d84a04988710a7b9bcf702b18",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "3864c6ba1e041bc75342353a70fa2a2c6f909923",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: call sk_data_ready() after listener migration\n\nWhen inet_csk_listen_stop() migrates an established child socket from\na closing listener to another socket in the same SO_REUSEPORT group,\nthe target listener gets a new accept-queue entry via\ninet_csk_reqsk_queue_add(), but that path never notifies the target\nlistener\u0027s waiters. A nonblocking accept() still works because it\nchecks the queue directly, but poll()/epoll_wait() waiters and\nblocking accept() callers can also remain asleep indefinitely.\n\nCall READ_ONCE(nsk-\u003esk_data_ready)(nsk) after a successful migration\nin inet_csk_listen_stop().\n\nHowever, after inet_csk_reqsk_queue_add() succeeds, the ref acquired\nin reuseport_migrate_sock() is effectively transferred to\nnreq-\u003ersk_listener. Another CPU can then dequeue nreq via accept()\nor listener shutdown, hit reqsk_put(), and drop that listener ref.\nSince listeners are SOCK_RCU_FREE, wrap the post-queue_add()\ndereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also\ncovers the existing sock_net(nsk) access in that path.\n\nThe reqsk_timer_handler() path does not need the same changes for two\nreasons: half-open requests become readable only after the final ACK,\nwhere tcp_child_process() already wakes the listener; and once nreq is\nvisible via inet_ehash_insert(), the success path no longer touches\nnsk directly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local socket lifecycle operations \u2014 creating an SO_REUSEPORT group, enabling migration, and closing the source listener while accepting/closing the target. A remote peer cannot set up the migration group or drive the race, so the vector is Local.\nAC:L - The attacker controls both sides of the race (the closing listener via inet_csk_listen_stop and the concurrent accept/close that drops the listener\u0027s last ref), and the missed-wakeup half is deterministic; per guidance an attacker-created race is Low.\nPR:L - Migration must be enabled, requiring CAP_NET_ADMIN to set the per-netns net.ipv4.tcp_migrate_req sysctl (or a SK_REUSEPORT/migrate BPF prog), all of which an unprivileged user obtains in a user namespace via unshare -Urn.\nUI:N - Triggering depends only on the attacker\u0027s own socket operations; no action by any other user is required.\nS:U - The use-after-free and its impact are confined to the kernel\u0027s own memory/security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of a SOCK_RCU_FREE listener socket lets reallocated/freed memory be read (e.g., via sock_net(nsk)), enabling kernel information disclosure.\nI:H - The freed socket is dereferenced for sock_net(nsk) in __NET_INC_STATS (a pointer-controlled increment) and sk_data_ready(nsk) (a function-pointer call), giving an attacker-influenced write/control-flow primitive after heap grooming.\nA:H - The use-after-free reliably crashes the kernel, and the always-present missed wakeup hangs a listener\u0027s accept/poll/epoll waiters indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:10.115Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704"
        },
        {
          "url": "https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337"
        },
        {
          "url": "https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18"
        },
        {
          "url": "https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923"
        }
      ],
      "title": "tcp: call sk_data_ready() after listener migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46015",
    "datePublished": "2026-05-27T12:56:17.249Z",
    "dateReserved": "2026-05-13T15:03:33.092Z",
    "dateUpdated": "2026-09-08T08:49:01.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46149 (GCVE-0-2026-46149)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:36 – Updated: 2026-08-05 12:30

Title

scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() will be triggered. Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow") added the same bound to the target_lu_gp_members_show() but the tg_pt_gp variant was missed so resolve that here.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/d3cc9d490c207d57a…
https://git.kernel.org/stable/c/db0a4759d62cad4ff…
https://git.kernel.org/stable/c/12f2201a56957ba02…
https://git.kernel.org/stable/c/1f678d13e939f9184…
https://git.kernel.org/stable/c/72cc5ea7ef32bb5fa…
https://git.kernel.org/stable/c/00d91bfdce5033f5d…
https://git.kernel.org/stable/c/e501154f9d82c95d2…
https://git.kernel.org/stable/c/772a896a56e0e3ef9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < d3cc9d490c207d57a289054397349f6f8c90354e (git) Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < db0a4759d62cad4ff891e2d81ae4be73bb57f4a4 (git) Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < 12f2201a56957ba020392223a7393a5eba080c1b (git) Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < 1f678d13e939f91840cb1ebe9b88544923539d3c (git) Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < 72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e (git) Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < 00d91bfdce5033f5d9b4915638ae9b0553848b5d (git) Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < e501154f9d82c95d2719bcbbaf679d8fd3226ef7 (git) Affected: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 , < 772a896a56e0e3ef9424a025cec9176f9d8f4552 (git)
Linux	Linux	Affected: 2.6.38 Unaffected: 0 , < 2.6.38 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3cc9d490c207d57a289054397349f6f8c90354e",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            },
            {
              "lessThan": "db0a4759d62cad4ff891e2d81ae4be73bb57f4a4",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            },
            {
              "lessThan": "12f2201a56957ba020392223a7393a5eba080c1b",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            },
            {
              "lessThan": "1f678d13e939f91840cb1ebe9b88544923539d3c",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            },
            {
              "lessThan": "72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            },
            {
              "lessThan": "00d91bfdce5033f5d9b4915638ae9b0553848b5d",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            },
            {
              "lessThan": "e501154f9d82c95d2719bcbbaf679d8fd3226ef7",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            },
            {
              "lessThan": "772a896a56e0e3ef9424a025cec9176f9d8f4552",
              "status": "affected",
              "version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()\n\ntarget_tg_pt_gp_members_show() formats LUN paths with snprintf() into a\n256-byte stack buffer, then will memcpy() cur_len bytes from that\nbuffer.  snprintf() returns the length the output would have had, which\ncan exceed the buffer size when the fabric WWN is long because iSCSI IQN\nnames can be up to 223 bytes.  The check at the memcpy() site only\nguards the destination page write, not the source read, so memcpy() will\nread past the stack buffer and copy adjacent stack contents to the sysfs\nreader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic()\nwill be triggered.\n\nCommit 27e06650a5ea (\"scsi: target: target_core_configfs: Add length\ncheck to avoid buffer overflow\") added the same bound to the\ntarget_lu_gp_members_show() but the tg_pt_gp variant was missed so\nresolve that here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by reading a configfs/sysfs attribute file (target/.../alua/tg_pt_gps/\u003cgrp\u003e/members); there is no network-reachable path and the formatted IQN comes from local admin config, so it requires local system access.\nAC:L - Given a target configured with a sufficiently long iSCSI IQN (the vulnerable configuration), simply reading the file deterministically triggers the out-of-bounds read/fortify_panic with no race or memory-layout dependency.\nPR:L - The members attribute is CONFIGFS_ATTR_RO (mode 0444, world-readable) with no capability check in the show path, so any unprivileged local user who can read the globally-mounted configfs file triggers it.\nUI:N - Exploitation is a single read() of the file with no victim/user interaction required.\nS:U - The impact (stack info leak / panic) stays within the kernel\u0027s own security authority with no crossing of a trust boundary such as a VM or IOMMU.\nC:H - The memcpy reads past the 256-byte stack buffer and copies adjacent kernel stack contents (potential pointers/canary) into the userspace-readable sysfs page, an out-of-bounds read disclosing kernel memory.\nI:N - The destination page write is bounded by the PAGE_SIZE check, so no kernel memory is modified; the bug is a read-only overflow providing no write primitive.\nA:H - With CONFIG_FORTIFY_SOURCE enabled, the over-read memcpy triggers fortify_panic(), causing a kernel panic (denial of service)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:02.477Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3cc9d490c207d57a289054397349f6f8c90354e"
        },
        {
          "url": "https://git.kernel.org/stable/c/db0a4759d62cad4ff891e2d81ae4be73bb57f4a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f2201a56957ba020392223a7393a5eba080c1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f678d13e939f91840cb1ebe9b88544923539d3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e"
        },
        {
          "url": "https://git.kernel.org/stable/c/00d91bfdce5033f5d9b4915638ae9b0553848b5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e501154f9d82c95d2719bcbbaf679d8fd3226ef7"
        },
        {
          "url": "https://git.kernel.org/stable/c/772a896a56e0e3ef9424a025cec9176f9d8f4552"
        }
      ],
      "title": "scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46149",
    "datePublished": "2026-05-28T09:36:05.706Z",
    "dateReserved": "2026-05-13T15:03:33.101Z",
    "dateUpdated": "2026-08-05T12:30:02.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46266 (GCVE-0-2026-46266)

Vulnerability from cvelistv5 – Published: 2026-06-03 15:50 – Updated: 2026-09-02 12:49

Title

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Summary

In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST") pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner "man 7 raw" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/47276297140ee6712…
https://git.kernel.org/stable/c/db76b75ede3810e7c…
https://git.kernel.org/stable/c/19e42490c89bac9a3…
https://git.kernel.org/stable/c/531c1aec81bfe19d0…
https://git.kernel.org/stable/c/719d3932b8f6e3348…
https://git.kernel.org/stable/c/c89477ad794468673…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 47276297140ee6712646f9b19fb04fe26daedd01 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < db76b75ede3810e7cf9cfea5067d4f3e0993768b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 19e42490c89bac9a388f28179e66bebbef350f99 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 531c1aec81bfe19d00af13da5531fbb8209e4bd2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 719d3932b8f6e3348ce2f0ac58e278301fc17575 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c89477ad79446867394360b29bb801010fc3ff22 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/icmp.c",
            "net/ipv6/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "47276297140ee6712646f9b19fb04fe26daedd01",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "db76b75ede3810e7cf9cfea5067d4f3e0993768b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "19e42490c89bac9a388f28179e66bebbef350f99",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "531c1aec81bfe19d00af13da5531fbb8209e4bd2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "719d3932b8f6e3348ce2f0ac58e278301fc17575",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c89477ad79446867394360b29bb801010fc3ff22",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/icmp.c",
            "net/ipv6/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP\n\nYizhou Zhao reported that simply having one RAW socket on protocol\nIPPROTO_RAW (255) was dangerous.\n\n  socket(AF_INET, SOCK_RAW, 255);\n\nA malicious incoming ICMP packet can set the protocol field to 255\nand match this socket, leading to FNHE cache changes.\n\ninner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\")\npkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner\n\n\"man 7 raw\" states:\n\n  A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able\n  to send any IP protocol that is specified in the passed header.\n  Receiving of all IP protocols via IPPROTO_RAW is not possible\n  using raw sockets.\n\nMake sure we drop these malicious packets."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when a remotely sourced ICMP error (DEST_UNREACH/FRAG_NEEDED or REDIRECT) is received and processed through icmp_rcv() \u2192 icmp_unreach()/icmp_redirect() \u2192 icmp_socket_deliver(), which is standard internet-facing IPv4 input on any host accepting ICMP.\nAC:L - Exploitation is a single, deterministic crafted ICMP packet (inner IP proto=255, attacker-chosen daddr/PMTU) matching an open IPPROTO_RAW socket; an attacker can reliably create that socket via CAP_NET_RAW in a user+network namespace (unshare -Urn) without winning a race.\nPR:N - The network trigger requires no authentication or victim credentials\u2014only delivery of forged ICMP to the target IP; the remote attacker does not need local privileges even though a local IPPROTO_RAW socket must exist on the victim (typically opened by a daemon or a co-resident userns holder).\nUI:N - No victim user action is required beyond normal network operation; the attacker sends ICMP directly to the host without tricking anyone into clicking, mounting, or opening files.\nS:U - Impact is confined to the kernel IPv4 routing/FNHE cache within the same network namespace; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:N - This is a missing validation/logic bug that poisons route-cache metadata (PMTU/gateway); there is no memory read, pointer leak, or information-disclosure primitive.\nI:H - Before the fix, raw_err() unconditionally calls ipv4_sk_update_pmtu()/ipv4_sk_redirect(), letting a remote attacker inject attacker-controlled PMTU and gateway values into the system-wide FNHE exception cache for arbitrary destination addresses, altering forwarding for all local traffic to those destinations.\nA:H - Repeated forged ICMP FRAG_NEEDED packets can persistently force minimum PMTU entries in FNHE for chosen destinations, causing severe throughput collapse and connectivity failure for affected flows across the entire host or shared network namespace."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T12:49:33.535Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/47276297140ee6712646f9b19fb04fe26daedd01"
        },
        {
          "url": "https://git.kernel.org/stable/c/db76b75ede3810e7cf9cfea5067d4f3e0993768b"
        },
        {
          "url": "https://git.kernel.org/stable/c/19e42490c89bac9a388f28179e66bebbef350f99"
        },
        {
          "url": "https://git.kernel.org/stable/c/531c1aec81bfe19d00af13da5531fbb8209e4bd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/719d3932b8f6e3348ce2f0ac58e278301fc17575"
        },
        {
          "url": "https://git.kernel.org/stable/c/c89477ad79446867394360b29bb801010fc3ff22"
        }
      ],
      "title": "inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46266",
    "datePublished": "2026-06-03T15:50:07.907Z",
    "dateReserved": "2026-05-13T15:03:33.108Z",
    "dateUpdated": "2026-09-02T12:49:33.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46306 (GCVE-0-2026-46306)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:46 – Updated: 2026-09-08 08:49

Title

flow_dissector: do not dissect PPPoE PFC frames

Summary

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit. During the review process of that commit [1], support for PFC is suggested. However, having a compressed (1-byte) protocol field means the subsequent PPP payload is shifted by one byte, causing 4-byte misalignment for the network header and an unaligned access exception on some architectures. The exception can be reproduced by sending a PPPoE PFC frame to an ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE session is active on that interface: $ 0 : 00000000 80c40000 00000000 85144817 $ 4 : 00000008 00000100 80a75758 81dc9bb8 $ 8 : 00000010 8087ae2c 0000003d 00000000 $12 : 000000e0 00000039 00000000 00000000 $16 : 85043240 80a75758 81dc9bb8 00006488 $20 : 0000002f 00000007 85144810 80a70000 $24 : 81d1bda0 00000000 $28 : 81dc8000 81dc9aa8 00000000 805ead08 Hi : 00009d51 Lo : 2163358a epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50 ra : 805ead08 __skb_get_hash_net+0x74/0x12c Status: 11000403 KERNEL EXL IE Cause : 40800010 (ExcCode 04) BadVA : 85144817 PrId : 0001992f (MIPS 1004Kc) Call Trace: [<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50 [<805ead08>] __skb_get_hash_net+0x74/0x12c [<805ef330>] get_rps_cpu+0x1b8/0x3fc [<805fca70>] netif_receive_skb_list_internal+0x324/0x364 [<805fd120>] napi_complete_done+0x68/0x2a4 [<8058de5c>] mtk_napi_rx+0x228/0xfec [<805fd398>] __napi_poll+0x3c/0x1c4 [<805fd754>] napi_threaded_poll_loop+0x234/0x29c [<805fd848>] napi_threaded_poll+0x8c/0xb0 [<80053544>] kthread+0x104/0x12c [<80002bd8>] ret_from_kernel_thread+0x14/0x1c Code: 02d51821 1060045b 00000000 <8c640000> 3084000f 2c820005 144001a2 00042080 8e220000 To reduce the attack surface and maintain performance, do not process PPPoE PFC frames. [1] https://lore.kernel.org/r/20220630231016.GA392@debian.home

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/e7c811ca372d53c2b…
https://git.kernel.org/stable/c/abc5bc84e0f2edc7e…
https://git.kernel.org/stable/c/18ae9eacfc95cc715…
https://git.kernel.org/stable/c/db104b0d8a7856397…
https://git.kernel.org/stable/c/6044392d9cace3a36…
https://git.kernel.org/stable/c/0d00b901506971294…
https://git.kernel.org/stable/c/7c93f353eab4ea911…
https://git.kernel.org/stable/c/d6c19b31a3c1d519f…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 10f665b52a75df6eb26ddebbbc072ee264183731 , < e7c811ca372d53c2be7d01a1614e71fae1054836 (git) Affected: d7e541e86122d21f71eb71c5dfa7fb1eb6623fe8 , < abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < db104b0d8a7856397c0469d83a4289adf7c54863 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 6044392d9cace3a3672b02c8bc7d38b502e51734 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 0d00b9015069712944934bab09eaa6c542143049 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 7c93f353eab4ea911e394630f07d72e040a729d8 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < d6c19b31a3c1d519fabdcf0aa239e6b6109b9473 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:29.408Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/flow_dissector.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7c811ca372d53c2be7d01a1614e71fae1054836",
              "status": "affected",
              "version": "10f665b52a75df6eb26ddebbbc072ee264183731",
              "versionType": "git"
            },
            {
              "lessThan": "abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200",
              "status": "affected",
              "version": "d7e541e86122d21f71eb71c5dfa7fb1eb6623fe8",
              "versionType": "git"
            },
            {
              "lessThan": "18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3",
              "status": "affected",
              "version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
              "versionType": "git"
            },
            {
              "lessThan": "db104b0d8a7856397c0469d83a4289adf7c54863",
              "status": "affected",
              "version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
              "versionType": "git"
            },
            {
              "lessThan": "6044392d9cace3a3672b02c8bc7d38b502e51734",
              "status": "affected",
              "version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
              "versionType": "git"
            },
            {
              "lessThan": "0d00b9015069712944934bab09eaa6c542143049",
              "status": "affected",
              "version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
              "versionType": "git"
            },
            {
              "lessThan": "7c93f353eab4ea911e394630f07d72e040a729d8",
              "status": "affected",
              "version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
              "versionType": "git"
            },
            {
              "lessThan": "d6c19b31a3c1d519fabdcf0aa239e6b6109b9473",
              "status": "affected",
              "version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/flow_dissector.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nflow_dissector: do not dissect PPPoE PFC frames\n\nRFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT\nRECOMMENDED for PPPoE. In practice, pppd does not support negotiating\nPFC for PPPoE sessions, and the flow dissector driver has assumed an\nuncompressed frame until the blamed commit.\n\nDuring the review process of that commit [1], support for PFC is\nsuggested. However, having a compressed (1-byte) protocol field means\nthe subsequent PPP payload is shifted by one byte, causing 4-byte\nmisalignment for the network header and an unaligned access exception\non some architectures.\n\nThe exception can be reproduced by sending a PPPoE PFC frame to an\nethernet interface of a MIPS board, with RPS enabled, even if no PPPoE\nsession is active on that interface:\n\n$ 0   : 00000000 80c40000 00000000 85144817\n$ 4   : 00000008 00000100 80a75758 81dc9bb8\n$ 8   : 00000010 8087ae2c 0000003d 00000000\n$12   : 000000e0 00000039 00000000 00000000\n$16   : 85043240 80a75758 81dc9bb8 00006488\n$20   : 0000002f 00000007 85144810 80a70000\n$24   : 81d1bda0 00000000\n$28   : 81dc8000 81dc9aa8 00000000 805ead08\nHi    : 00009d51\nLo    : 2163358a\nepc   : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50\nra    : 805ead08 __skb_get_hash_net+0x74/0x12c\nStatus: 11000403        KERNEL EXL IE\nCause : 40800010 (ExcCode 04)\nBadVA : 85144817\nPrId  : 0001992f (MIPS 1004Kc)\nCall Trace:\n[\u003c805e91f0\u003e] __skb_flow_dissect+0x1b0/0x1b50\n[\u003c805ead08\u003e] __skb_get_hash_net+0x74/0x12c\n[\u003c805ef330\u003e] get_rps_cpu+0x1b8/0x3fc\n[\u003c805fca70\u003e] netif_receive_skb_list_internal+0x324/0x364\n[\u003c805fd120\u003e] napi_complete_done+0x68/0x2a4\n[\u003c8058de5c\u003e] mtk_napi_rx+0x228/0xfec\n[\u003c805fd398\u003e] __napi_poll+0x3c/0x1c4\n[\u003c805fd754\u003e] napi_threaded_poll_loop+0x234/0x29c\n[\u003c805fd848\u003e] napi_threaded_poll+0x8c/0xb0\n[\u003c80053544\u003e] kthread+0x104/0x12c\n[\u003c80002bd8\u003e] ret_from_kernel_thread+0x14/0x1c\n\nCode: 02d51821  1060045b  00000000 \u003c8c640000\u003e 3084000f  2c820005  144001a2  00042080  8e220000\n\nTo reduce the attack surface and maintain performance, do not process\nPPPoE PFC frames.\n\n[1] https://lore.kernel.org/r/20220630231016.GA392@debian.home"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is triggered by a crafted PPPoE session Ethernet frame received on a network interface and processed in the core packet-receive path (NAPI \u2192 `netif_receive_skb_list_internal` \u2192 `get_rps_cpu` \u2192 `__skb_get_hash_net` \u2192 `__skb_flow_dissect`), which matches kernel guidance for net-stack bugs reachable via received packets.\nAC:L - An attacker fully controls the malicious PPPoE PFC frame contents; once RPS (or another flow-hash caller such as tc flower ingress) is active on the target interface, sending the frame reliably reproduces the misaligned IPv4 header access and kernel exception without races or victim-specific timing.\nPR:N - Exploitation requires only the ability to transmit Ethernet frames to the victim interface; no local account, capabilities, or PPPoE session establishment is needed, as confirmed by the fix commit reproducing the crash with no active PPPoE session.\nUI:N - No victim user action is required beyond normal network operation; the kernel processes the injected frame automatically during receive-side RPS flow hashing.\nS:U - Impact is confined to kernel crash/DoS on the affected host; there is no cross-boundary escape from a sandbox, VM guest, or separate security authority.\nC:N - The bug causes an unaligned load fault while parsing attacker-supplied skb data at a wrong offset; it does not perform an out-of-bounds read of kernel memory or disclose kernel secrets, only misreads bytes within the crafted packet before faulting.\nI:N - There is no memory corruption, arbitrary write, or type confusion; the failure mode is a load-address exception on strict-alignment architectures (e.g., MIPS) without modifying kernel or application data.\nA:H - The documented impact is a kernel exception/oops in `__skb_flow_dissect` (MIPS ExcCode 04 unaligned access), which crashes or panics the system and can be retriggered remotely by resending the malicious frame."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:08.733Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7c811ca372d53c2be7d01a1614e71fae1054836"
        },
        {
          "url": "https://git.kernel.org/stable/c/abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/db104b0d8a7856397c0469d83a4289adf7c54863"
        },
        {
          "url": "https://git.kernel.org/stable/c/6044392d9cace3a3672b02c8bc7d38b502e51734"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d00b9015069712944934bab09eaa6c542143049"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c93f353eab4ea911e394630f07d72e040a729d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6c19b31a3c1d519fabdcf0aa239e6b6109b9473"
        }
      ],
      "title": "flow_dissector: do not dissect PPPoE PFC frames",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46306",
    "datePublished": "2026-06-08T15:46:33.936Z",
    "dateReserved": "2026-05-13T15:03:33.111Z",
    "dateUpdated": "2026-09-08T08:49:29.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46330 (GCVE-0-2026-46330)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:25 – Updated: 2026-08-05 12:31

Title

Revert "net/smc: Introduce TCP ULP support"

Summary

In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-place, which violates core VFS invariants that assume these structures are immutable for an open file, creating a risk of use after free errors and general system instability. Given the severity of this design flaw and the fact that cleaner alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application transparency, the correct course of action is to remove this feature entirely.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/6c505d95c69e27dbf…
https://git.kernel.org/stable/c/df31a6b0a3057e669…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 , < 6c505d95c69e27dbf28fea29dc84d2498d69515c (git) Affected: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 , < df31a6b0a3057e66994ad6ccf5d95b9b9514f033 (git)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6c505d95c69e27dbf28fea29dc84d2498d69515c",
              "status": "affected",
              "version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
              "versionType": "git"
            },
            {
              "lessThan": "df31a6b0a3057e66994ad6ccf5d95b9b9514f033",
              "status": "affected",
              "version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"net/smc: Introduce TCP ULP support\"\n\nThis reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.\n\nAs reported by Al Viro, the TCP ULP support for SMC is fundamentally\nbroken. The implementation attempts to convert an active TCP socket\ninto an SMC socket by modifying the underlying `struct file`, dentry,\nand inode in-place, which violates core VFS invariants that assume\nthese structures are immutable for an open file, creating a risk of\nuse after free errors and general system instability.\n\nGiven the severity of this design flaw and the fact that cleaner\nalternatives (e.g., LD_PRELOAD, BPF) exist for legacy application\ntransparency, the correct course of action is to remove this feature\nentirely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only via the local setsockopt(TCP_ULP, \"smc\") syscall on a TCP socket owned by the caller; smc_ulp_init() is not invoked from packet receive or any remote network path. The bug is triggered exclusively through the setsockopt(2) syscall on a TCP socket owned by the attacker; smc_ulp_init() is registered as a TCP ULP handler and is invoked from do_tcp_setsockopt() \u2192 tcp_set_ulp(), not from any network packet-receive or remote protocol path.\nAC:L - On systems with CONFIG_SMC enabled, an attacker fully controls socket creation, the pre-connect setsockopt call, and subsequent close/dup/fork races needed to trigger the corrupted VFS state and resulting UAF. An attacker fully controls socket creation, the setsockopt(TCP_ULP, \"smc\") call, and subsequent lifecycle operations (close, dup, connect); once preconditions are met the VFS corruption in smc_ulp_init() is deterministic and UAF/double-free can be provoked on demand without conditions outside attacker control.\nPR:L - Any unprivileged local user who can open a TCP socket may call setsockopt(TCP_ULP); module autoload uses CAP_NET_ADMIN which is obtainable in user namespaces, and no real-root capability is required when SMC is already loaded. No real-root capability is required\u2014any unprivileged local user who can create a SOCK_STREAM TCP socket and call setsockopt on it can reach smc_ulp_init(), including via user namespaces; TCP_ULP has no CAP_NET_ADMIN gate (unlike TCP congestion control), and module autoload is only needed if SMC is not already loaded.\nUI:N - Exploitation requires no action from another user or administrator; the attacker triggers the bug directly through their own socket file descriptor. Exploitation requires no action from a victim user; a local attacker can open a socket, invoke setsockopt(TCP_ULP, \"smc\"), and trigger the corrupted VFS state through normal close/dup operations in their own process.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary, not a cross-boundary escape such as guest-to-host or IOMMU bypass. Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-security-boundary escape.\nC:H - The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The fix commit and Al Viro\u0027s report explicitly identify use-after-free risk from in-place modification of struct file, dentry, and inode on an open file descriptor, which can yield arbitrary kernel memory read primitives through corrupted inode/file reference counting.\nI:H - UAF and broken VFS reference counting on live file descriptors enable heap grooming and arbitrary kernel write/control-flow hijacking, not merely a bounded or cosmetic corruption.\nA:H - The design flaw causes use-after-free, double-free, and general system instability during file close/__fput paths, readily producing kernel oops/panic and complete denial of service on affected IBM Z/RoCE systems running SMC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:24.893Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6c505d95c69e27dbf28fea29dc84d2498d69515c"
        },
        {
          "url": "https://git.kernel.org/stable/c/df31a6b0a3057e66994ad6ccf5d95b9b9514f033"
        }
      ],
      "title": "Revert \"net/smc: Introduce TCP ULP support\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46330",
    "datePublished": "2026-06-09T12:25:59.413Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-08-05T12:31:24.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53002 (GCVE-0-2026-53002)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-09-10 12:04

Title

netfilter: conntrack: remove sprintf usage

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..]

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

Linux mitre root

References

15 references

URL	Tags
https://git.kernel.org/stable/c/2f793ba78470a99f4…
https://git.kernel.org/stable/c/6bbf829b4c1b44c94…
https://git.kernel.org/stable/c/ab64e61c9323fa6de…
https://git.kernel.org/stable/c/1c9fb8aeed06790d4…
https://git.kernel.org/stable/c/a8e0a32a23d3f3486…
https://git.kernel.org/stable/c/8e3be0d12615a173f…
https://git.kernel.org/stable/c/c08ff52e44945e6ef…
https://git.kernel.org/stable/c/6e7066bdb481a87fe…
https://access.redhat.com/security/cve/CVE-2026-53002	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492329	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:66180	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66000	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64770	vendor-advisoryx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…

Impacted products

12 products

Vendor	Product	Version
Linux	Linux	Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < 2f793ba78470a99f40389b7dc60a81d9f5ad3956 (git) Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < 6bbf829b4c1b44c941c47dd0d710f1393258f3d5 (git) Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < ab64e61c9323fa6de21bd20da1ddb29a0fb65d34 (git) Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < 1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e (git) Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < a8e0a32a23d3f34862af3b4da792ecb3a891a9a3 (git) Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < 8e3be0d12615a173fe260cd42753ca7a001acbf2 (git) Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < c08ff52e44945e6ef4ce0790f49ea761b060c45b (git) Affected: 9fafcd7b203229c3f3893a475741afc27e276306 , < 6e7066bdb481a87fe88c4fa563e348c03b2d373d (git)
Linux	Linux	Affected: 2.6.20 Unaffected: 0 , < 2.6.20 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.141 , ≤ 6.6.* (semver) Unaffected: 6.12.91 , ≤ 6.12.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.160.1.rt7.501.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.160.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.46.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.160.1.rt7.501.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.160.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.46.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s netfilter conntrack module. This vulnerability arises from the use of `sprintf` and insufficient buffer sizing in the `mangle_content_len()` function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue to cause a denial of service or other unspecified impacts."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T12:04:52.973Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53002"
          },
          {
            "name": "RHBZ#2492329",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53002.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66180"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66000"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:64770"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:66180: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66000: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:64770: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: netfilter: conntrack: remove sprintf usage",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent the nf_conntrack_sip and nf_nat_sip modules from being loaded. See https://access.redhat.com/solutions/41278 for instructions."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:55.785Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_nat_amanda.c",
            "net/netfilter/nf_nat_sip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f793ba78470a99f40389b7dc60a81d9f5ad3956",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            },
            {
              "lessThan": "6bbf829b4c1b44c941c47dd0d710f1393258f3d5",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            },
            {
              "lessThan": "ab64e61c9323fa6de21bd20da1ddb29a0fb65d34",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            },
            {
              "lessThan": "1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            },
            {
              "lessThan": "a8e0a32a23d3f34862af3b4da792ecb3a891a9a3",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            },
            {
              "lessThan": "8e3be0d12615a173fe260cd42753ca7a001acbf2",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            },
            {
              "lessThan": "c08ff52e44945e6ef4ce0790f49ea761b060c45b",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            },
            {
              "lessThan": "6e7066bdb481a87fe88c4fa563e348c03b2d373d",
              "status": "affected",
              "version": "9fafcd7b203229c3f3893a475741afc27e276306",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_nat_amanda.c",
            "net/netfilter/nf_nat_sip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: remove sprintf usage\n\nReplace it with scnprintf, the buffer sizes are expected to be large enough\nto hold the result, no need for snprintf+overflow check.\n\nIncrease buffer size in mangle_content_len() while at it.\n\nBUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270\nWrite of size 1 at addr [..]\n vsnprintf+0xea5/0x1270\n sprintf+0xb1/0xe0\n mangle_content_len+0x1ac/0x280\n nf_nat_sdp_session+0x1cc/0x240\n process_sdp+0x8f8/0xb80\n process_invite_request+0x108/0x2b0\n process_sip_msg+0x5da/0xf50\n sip_help_tcp+0x45e/0x780\n nf_confirm+0x34d/0x990\n [..]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable SIP NAT helper is reached from network packet processing when a target acts as a SIP-aware NAT/conntrack gateway. A remote peer can send crafted SIP/SDP traffic through that configured path.\nAC:L - No race or hard-to-control state is required; the attacker controls the SIP/SDP payload and can drive the oversized Content-Length recomputation. The needed NAT/helper configuration is a normal deployment condition for SIP ALG/firewall use.\nPR:N - In the remote deployment scenario, the attacker only sends network traffic and does not need local credentials or administrative privileges on the target. Local helper setup would require CAP_NET_ADMIN, but that is not required when attacking an already configured SIP NAT gateway.\nUI:N - No victim user action is required once the vulnerable helper is active. Packet processing happens automatically in the netfilter conntrack/NAT path.\nS:U - The corruption occurs inside the Linux kernel networking stack and impacts the same kernel security authority. There is no VM, IOMMU, or cross-authority boundary change.\nC:H - This is kernel stack memory corruption from an out-of-bounds sprintf write. Even though the report shows a KASAN crash, such memory corruption can plausibly be leveraged toward broader kernel compromise, so the higher severity value is appropriate.\nI:H - The bug is an out-of-bounds write on the kernel stack in packet processing. Kernel memory corruption can plausibly alter control data or enable code execution, so integrity impact is high.\nA:H - The reported failure is a KASAN stack-out-of-bounds write in kernel context and can crash or panic the system. The crafted traffic can be sent repeatedly to sustain denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:32.201Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bbf829b4c1b44c941c47dd0d710f1393258f3d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab64e61c9323fa6de21bd20da1ddb29a0fb65d34"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8e0a32a23d3f34862af3b4da792ecb3a891a9a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e3be0d12615a173fe260cd42753ca7a001acbf2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c08ff52e44945e6ef4ce0790f49ea761b060c45b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e7066bdb481a87fe88c4fa563e348c03b2d373d"
        }
      ],
      "title": "netfilter: conntrack: remove sprintf usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53002",
    "datePublished": "2026-06-24T16:29:14.391Z",
    "dateReserved": "2026-06-09T07:44:35.377Z",
    "dateUpdated": "2026-09-10T12:04:52.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53223 (GCVE-0-2026-53223)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50

Title

net: guard timestamp cmsgs to real error queue skbs

Summary

In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/24a0d548d3a765cd4…
https://git.kernel.org/stable/c/71ff5cdd5da61d043…
https://git.kernel.org/stable/c/ad9a0374ee6d11048…
https://git.kernel.org/stable/c/b903e9b5629ec8dd6…
https://git.kernel.org/stable/c/e0665b2a8e90bb08b…
https://git.kernel.org/stable/c/3dde4fb941fa5649a…
https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6…
https://git.kernel.org/stable/c/1ee90b77b727df903…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 8605330aac5a5785630aec8f64378a54891937cc , < 24a0d548d3a765cd4558224e4f8e06e14cba26e3 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < 71ff5cdd5da61d0438e902aa0fd68c28bc901abe (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < ad9a0374ee6d11048e1f74cd5180bad58b9848b4 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < b903e9b5629ec8dd6db92174070045bf81ad7060 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < e0665b2a8e90bb08bd205062c75662b502d31797 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < 3dde4fb941fa5649ab809f6cd3e20e0c424a4e31 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < 1ee90b77b727df903033db873c75caac5c27ec98 (git) Affected: cdaf15b43bd31003220cb080bcbbd57787a2fca9 (git) Affected: 4.10.14 , < 4.11 (semver)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:50:05.974Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sock.h",
            "net/core/skbuff.c",
            "net/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24a0d548d3a765cd4558224e4f8e06e14cba26e3",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "lessThan": "71ff5cdd5da61d0438e902aa0fd68c28bc901abe",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "lessThan": "ad9a0374ee6d11048e1f74cd5180bad58b9848b4",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "lessThan": "b903e9b5629ec8dd6db92174070045bf81ad7060",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "lessThan": "e0665b2a8e90bb08bd205062c75662b502d31797",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "lessThan": "3dde4fb941fa5649ab809f6cd3e20e0c424a4e31",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "lessThan": "eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "lessThan": "1ee90b77b727df903033db873c75caac5c27ec98",
              "status": "affected",
              "version": "8605330aac5a5785630aec8f64378a54891937cc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cdaf15b43bd31003220cb080bcbbd57787a2fca9",
              "versionType": "git"
            },
            {
              "lessThan": "4.11",
              "status": "affected",
              "version": "4.10.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sock.h",
            "net/core/skbuff.c",
            "net/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.10.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type == PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local socket syscalls on an AF_PACKET socket, including setsockopt(), sending traffic that is tapped as PACKET_OUTGOING, and recvmsg(). Remote packets alone do not reach the bug without a local attacker-controlled packet socket.\nAC:L - The attacker controls the socket options, packet-socket receive queue pressure/drop count, and outgoing traffic needed to make the timestamp cmsg path run. No uncontrollable race or rare environmental condition is required for the highest-impact disclosure/crash scenario.\nPR:L - Creating AF_PACKET sockets requires CAP_NET_RAW in the governing user namespace. Because this capability can be obtained by an unprivileged local user in user/network namespaces on common deployments, this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker can configure the socket and trigger recvmsg() themselves. The bug is not dependent on opening a file, mounting media, or other user-assisted behavior.\nS:U - The impact remains within the kernel and the local host security authority. It does not cross a hypervisor, VM, IOMMU, or other separate security scope boundary.\nC:H - The bogus SCM_TIMESTAMPING_OPT_STATS cmsg can copy skb-\u003elen bytes from skb-\u003edata even when the skb is non-linear, reading past the linear head. That can disclose adjacent kernel heap contents to userspace, which is a high confidentiality impact.\nI:N - The investigated bug is an out-of-bounds read/copy-to-user and misclassification of skb metadata, not a kernel write primitive. I found no direct modification of kernel memory or protected data.\nA:H - The same invalid copy can trigger hardened usercopy failures or kernel oops/panic on hardened deployments. The local attacker can repeat the trigger, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:15.752Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98"
        }
      ],
      "title": "net: guard timestamp cmsgs to real error queue skbs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53223",
    "datePublished": "2026-06-25T08:39:24.588Z",
    "dateReserved": "2026-06-09T07:44:35.392Z",
    "dateUpdated": "2026-09-08T08:50:05.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:66180

CVE-2026-43133 (GCVE-0-2026-43133)

CVE-2026-43339 (GCVE-0-2026-43339)

CVE-2026-43493 (GCVE-0-2026-43493)

CVE-2026-46015 (GCVE-0-2026-46015)

CVE-2026-46149 (GCVE-0-2026-46149)

CVE-2026-46266 (GCVE-0-2026-46266)

CVE-2026-46306 (GCVE-0-2026-46306)

CVE-2026-46330 (GCVE-0-2026-46330)

CVE-2026-53002 (GCVE-0-2026-53002)

CVE-2026-53223 (GCVE-0-2026-53223)

Tags

Sightings

Nomenclature