{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.28.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.146.1.rt7.487.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.146.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.17.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.149.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-28T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface (uAPI) that cause an internal error. This issue arises when Work Queues (WQs) are specified to share the same Completion Queue (CQ), leading to an unstable system state."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1288",
                "description": "Improper Validation of Consistency within Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T12:04:20.631Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46117"
          },
          {
            "name": "RHBZ#2482576",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482576"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46117.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30129"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67720"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42552"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42550"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:30129: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65712: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67720: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42552: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42550: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mana/cq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71",
              "status": "affected",
              "version": "c15d7802a42402a87880a17eee89ff023e49ecc0",
              "versionType": "git"
            },
            {
              "lessThan": "9ef65af26b2a6738bf15812042e84b3112402d3a",
              "status": "affected",
              "version": "c15d7802a42402a87880a17eee89ff023e49ecc0",
              "versionType": "git"
            },
            {
              "lessThan": "db991ba50087ad99fa12a2c483aa3be19671ea73",
              "status": "affected",
              "version": "c15d7802a42402a87880a17eee89ff023e49ecc0",
              "versionType": "git"
            },
            {
              "lessThan": "159f2efabc89d3f931d38f2d35876535d4abf0a3",
              "status": "affected",
              "version": "c15d7802a42402a87880a17eee89ff023e49ecc0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mana/cq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()\n\nSashiko points out that the user can specify WQs sharing the same CQ as a\npart of the uAPI and this will trigger the WARN_ON() then go on to corrupt\nthe kernel.\n\nJust reject it outright and fail the QP creation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the RDMA userspace verbs interface (/dev/infiniband/uverbs\u003cN\u003e) by issuing a create-QP command locally; it is not exposed to network peers.\nAC:L - The condition is created entirely by the attacker (building an RWQ indirection table whose WQs share one CQ) and is deterministically triggered on the second loop iteration; there is no race or uncontrolled state.\nPR:L - Triggering only requires an unprivileged local process with access to the RDMA verbs device \u2014 the normal configuration on RDMA-enabled hosts \u2014 and no CAP_* check exists on the create-QP path.\nUI:N - The attacker performs all steps via its own verbs calls; no action by another user is required.\nS:U - The corruption stays within the kernel\u0027s own memory/security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - The overwrite leaks/dangles objects in cq_table[], and a use-after-free on these IRQ-dispatched structures can be leveraged to read kernel memory contents.\nI:H - The driver \"goes on to corrupt the kernel,\" leaving dangling function-pointer/context entries in a table called from interrupt context, providing a write/control-flow corruption primitive.\nA:H - The user-triggerable WARN_ON panics the system when panic_on_warn is set, and the subsequent kernel state corruption causes oopses/crashes regardless."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:49.531Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ef65af26b2a6738bf15812042e84b3112402d3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/db991ba50087ad99fa12a2c483aa3be19671ea73"
        },
        {
          "url": "https://git.kernel.org/stable/c/159f2efabc89d3f931d38f2d35876535d4abf0a3"
        }
      ],
      "title": "RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46117",
    "datePublished": "2026-05-28T09:35:32.344Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-09-16T12:04:20.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fsnotify.c",
            "fs/notify/mark.c",
            "include/linux/fsnotify_backend.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a24765332e129c1916d5a6615418b75599b8fcdc",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "4a7611ad653785fcdea5ff5f4441e2b7d05b7f11",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "04bb66be92f48ed13c3faf1139d892df228789bc",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "895ebbedf88318607c24acc0f591c74b165e1d0a",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "f130790f1acc8399f32652846c875a251efd040f",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "7baa02b0ae9d17ec5f08836d8ea88ce1927d0678",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "b7b24b28c8cd55844cab908f4f39dded638d5538",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "7746e3bd4cc19b5092e00d32d676e329bfcb6900",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fsnotify.c",
            "fs/notify/mark.c",
            "include/linux/fsnotify_backend.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: fix false positive on permission events\n\nfsnotify_get_mark_safe() may return false for a mark on an unrelated group,\nwhich results in bypassing the permission check.\n\nFix by skipping over detached marks that are not in the current group."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code runs in the context of a local file operation (open/read/exec) that triggers the fanotify permission event; the attacker bypasses the control by performing local file ops plus churning a local inotify watch. The fully-controllable, reliable attack is local (a remote file-server scenario would lose attacker control of the race).\nAC:L - The attacker controls both sides of the race \u2014 the lifecycle of the unrelated (unprivileged inotify) mark and the retried file operation \u2014 and each open() is a fresh permission event, so with unlimited retries the bypass is reliably reachable.\nPR:L - Exploitation only needs an unprivileged local account: creating an inotify watch on the parent directory and opening/executing the target file require no capabilities (the privileged CAP_SYS_ADMIN fanotify group is the victim control, not the attacker).\nUI:N - The attacker performs all actions (inotify churn plus repeated file access) with no interaction from any other user.\nS:U - The flaw and its impact are both mediated entirely within the kernel\u0027s own access-control path; no boundary to a separately-managed security authority (VM, IOMMU) is crossed.\nC:H - Bypassing FAN_ACCESS_PERM/FAN_OPEN_PERM lets read access to files the policy (AV/sandbox/EDR) would deny proceed; via targeted retries the attacker can force disclosure of chosen protected files, approaching total loss of confidentiality of protected resources.\nI:H - Bypassing FAN_OPEN_PERM/FAN_OPEN_EXEC_PERM lets writes to protected files and execution of binaries the policy would block proceed, allowing modification of protected resources and execution of disallowed code.\nA:N - The bug is fail-open (it only allows operations that should be blocked); it causes no crash, hang, or resource exhaustion, so availability is unaffected."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:03.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11"
        },
        {
          "url": "https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538"
        },
        {
          "url": "https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900"
        }
      ],
      "title": "fanotify: fix false positive on permission events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46150",
    "datePublished": "2026-05-28T09:36:06.494Z",
    "dateReserved": "2026-05-13T15:03:33.101Z",
    "dateUpdated": "2026-08-05T12:30:03.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.98.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.45.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s netfilter component, specifically within the Network Address Translation (NAT) subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system crash, leading to a Denial of Service (DoS), or to gain unauthorized access to sensitive information due to the partial exposure of internal hook data during error handling."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-763",
                "description": "Release of Invalid Pointer or Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T12:04:20.847Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53000"
          },
          {
            "name": "RHBZ#2492273",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492273"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53000.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55445"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67720"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:64808"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67720: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:64808: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: netfilter: nat: use kfree_rcu to release ops",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/netfilter/iptable_nat.c",
            "net/ipv6/netfilter/ip6table_nat.c",
            "net/netfilter/nf_nat_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "32fdd2e38e7435a368d88f5977a7d6585ebc8b0e",
              "status": "affected",
              "version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
              "versionType": "git"
            },
            {
              "lessThan": "3c7511f38ab511b791196b13ae48bf4973bf7dfd",
              "status": "affected",
              "version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
              "versionType": "git"
            },
            {
              "lessThan": "6eda0d771f94267f73f57c94630aa47e90957915",
              "status": "affected",
              "version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/netfilter/iptable_nat.c",
            "net/ipv6/netfilter/ip6table_nat.c",
            "net/netfilter/nf_nat_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nat: use kfree_rcu to release ops\n\nFlorian Westphal says:\n\n\"Historically this is not an issue, even for normal base hooks: the data\npath doesn\u0027t use the original nf_hook_ops that are used to register the\ncallbacks.\n\nHowever, in v5.14 I added the ability to dump the active netfilter\nhooks from userspace.\n\nThis code will peek back into the nf_hook_ops that are available\nat the tail of the pointer-array blob used by the datapath.\n\nThe nat hooks are special, because they are called indirectly from\nthe central nat dispatcher hook. They are currently invisible to\nthe nfnl hook dump subsystem though.\n\nBut once that changes the nat ops structures have to be deferred too.\"\n\nUpdate nf_nat_register_fn() to deal with partial exposition of the hooks\nfrom error path which can be also an issue for nfnetlink_hook."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local netfilter/nfnetlink operations, including hook dumps and NAT hook registration/unregistration via netlink or xtables control paths. Remote packets may traverse NAT hooks, but the unsafe freed nf_hook_ops metadata is exposed through local control-plane operations.\nAC:L - The relevant race is between hook dumping and NAT hook teardown/error unwind, and an attacker with netfilter control can drive both sides concurrently. There are no required conditions outside the attacker\u2019s influence beyond normal scheduling.\nPR:L - The paths require CAP_NET_ADMIN in the target network namespace. Netfilter/nftables operations are reachable by an unprivileged local user through user and network namespaces, so this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution. The attacker can issue the netlink/xtables operations directly.\nS:U - The impact is within the same kernel security authority and represents a standard local kernel memory-safety issue. It does not cross a VM, IOMMU, or similar separate security boundary.\nC:H - This is a use-after-free of kernel heap objects referenced by RCU-visible hook metadata. Reclaiming the freed object can drive kernel reads through attacker-influenced nf_hook_ops fields, making high confidentiality impact defensible.\nI:H - A kernel use-after-free is a memory corruption primitive and may be leveraged beyond a crash with heap grooming. Following the higher-severity rule for UAFs, arbitrary modification or code execution is defensible.\nA:H - The stale hook metadata can be dereferenced after free in kernel context. At minimum this can cause an oops/panic, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:31.130Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915"
        }
      ],
      "title": "netfilter: nat: use kfree_rcu to release ops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53000",
    "datePublished": "2026-06-24T16:29:12.635Z",
    "dateReserved": "2026-06-09T07:44:35.377Z",
    "dateUpdated": "2026-09-16T12:04:20.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_nego.c",
            "drivers/target/iscsi/iscsi_target_parameters.c",
            "drivers/target/iscsi/iscsi_target_parameters.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb84e974fb172bc71386289f37b78ea679410b39",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "b19382dfc6e7dee6d3859ba44b6ca29e97a51627",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "efe633e600a0ac68357206fede21b1ac8178f3b8",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "4e9f0c4a645c995bc75c06c7b3644254ffb4c76b",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "30bf335e8fe170322080ee001f05ca29c50680b3",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "594a40360012ce5f94c715d5e3b20fa3af7d525a",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "26e4a304b7e6f1338c675d527608d32549c091db",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "bf33e01f88388c43e285492a63e539df6ffed64c",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_nego.c",
            "drivers/target/iscsi/iscsi_target_parameters.c",
            "drivers/target/iscsi/iscsi_target_parameters.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n\niscsi_encode_text_output() concatenates \"key=value\\0\" records into\nlogin-\u003ersp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer\nallocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call\nsites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check\nthe remaining buffer capacity:\n\n\t*length += sprintf(output_buf, \"%s=%s\", er-\u003ekey, er-\u003evalue);\n\t*length += 1;\n\toutput_buf = textbuf + *length;\n\nThe 8192-byte ceiling at iscsi_target_check_login_request() bounds the\n*input* Login PDU payload, but a single PDU can carry up to 2048 minimal\nfour-byte \"a=b\\0\" pairs, each unknown key expanding to a 16-byte\n\"a=NotUnderstood\\0\" output record via iscsi_add_notunderstood_response().\n2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB\nheap overrun in the kmalloc-8k slab.\n\nThe fix introduces a static iscsi_encode_text_record() helper that uses\nsnprintf() with a per-call bounds check against the remaining buffer,\nand threads a u32 textbuf_size parameter through\niscsi_encode_text_output(). Both call sites in\niscsi_target_handle_csg_zero() (PHASE_SECURITY) and\niscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass\nMAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls\niscsi_release_extra_responses() to drop queued records, and returns -1;\nboth caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /\nISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,\nso the initiator sees an explicit failed-login response rather than a\nsilent connection drop. (Prior to this patch only the PHASE_OPERATIONAL\ncaller did that; the PHASE_SECURITY caller is converted to the same\nshape.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:56.451Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39"
        },
        {
          "url": "https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627"
        },
        {
          "url": "https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b"
        },
        {
          "url": "https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a"
        },
        {
          "url": "https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c"
        }
      ],
      "title": "scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63887",
    "datePublished": "2026-07-19T14:55:00.114Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:56.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7948af0dd03de84079dcd4dc215a69fd6fbb95d",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "badf178b76b0690851df00f4ca9cf2eb8eb0f963",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "6e22a1cdcc8277af4acc43710577157b77a02c5d",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "d3e9b79aa794f7a23e82de4d710e7d2df610e349",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "ec9f19d52074a191ed1756ed4a7d39fff1a2085c",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "5118ea225fe63b44207ba88047e4866e1ea43812",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "778c2ab142c625a8a8afa570e0f9b7873f445d99",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n\n1) DataDigest CRC buffer overread (4 bytes past text_in).\n\n   text_in is kzalloc()\u0027d at ALIGN(payload_length, 4).  rx_size is then\n   incremented by ISCSI_CRC_LEN to make room for the received DataDigest\n   in the iovec, but the same (now-bumped) rx_size is passed as the\n   buffer length to iscsit_crc_buf():\n\n       if (conn-\u003econn_ops-\u003eDataDigest) {\n               ...\n               rx_size += ISCSI_CRC_LEN;\n       }\n       ...\n       if (conn-\u003econn_ops-\u003eDataDigest) {\n               data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\n\n   iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\n   when DataDigest is negotiated it reads 4 bytes past the end of the\n   text_in allocation.  KASAN reproduces this directly on the unpatched\n   mainline tree as slab-out-of-bounds in crc32c() called from the Text\n   PDU path.  The OOB bytes feed crc32c() and are then compared against\n   the initiator-supplied checksum, so the value does not flow back to\n   the attacker, but the kernel does read past the buffer on every Text\n   PDU with DataDigest=CRC32C.\n\n   Fix by passing the actual padded payload length\n   (ALIGN(payload_length, 4)) that was used for the kzalloc().\n\n2) Stale cmd-\u003etext_in_ptr re-free (double-free) on ERL\u003e0 bad DataDigest\n   drop.\n\n   On DataDigest mismatch with ErrorRecoveryLevel \u003e 0 the handler\n   silently drops the PDU and lets the initiator plug the CmdSN gap:\n\n               kfree(text_in);\n               return 0;\n\n   cmd-\u003etext_in_ptr still points at the freed buffer.  The next Text\n   Request on the same ITT re-enters iscsit_setup_text_cmd(), which\n   unconditionally does\n\n       kfree(cmd-\u003etext_in_ptr);\n       cmd-\u003etext_in_ptr = NULL;\n\n   freeing the same pointer a second time.  Session teardown via\n   iscsit_release_cmd() has the same shape and hits the same double-free\n   if the connection is dropped before a second Text Request arrives.\n\n   On an unmodified mainline tree the bug-1 CRC overread fires first on\n   the initial valid Text Request and perturbs the subsequent state, so\n   #4 was isolated by building a kernel with only the bug-1 hunk of this\n   patch applied plus temporary printk() observability around the three\n   relevant kfree() sites.  The observability prints are not part of\n   this patch.  On that build, a three-PDU Text Request sequence after\n   login produces two back-to-back splats:\n\n       BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\n       BUG: KASAN: double-free in iscsit_release_cmd+0x??\n\n   showing the same pointer freed in the ERL\u003e0 drop path and again in\n   iscsit_setup_text_cmd() (next Text Request on the same ITT) and once\n   more in iscsit_release_cmd() (session teardown).  On distro kernels\n   with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\n   becomes a remote kernel BUG(); on non-hardened kernels it corrupts\n   the slab freelist.\n\n   Fix by clearing cmd-\u003etext_in_ptr after the kfree() in the ERL\u003e0 drop\n   path.  With both hunks applied #4 is directly observable on the stock\n   tree without observability printks; fixing bug-1 alone would mask #4\n   less, not more, so the hunks are submitted together.\n\nBoth fixes are one-liners.  The Text PDU state machine is unchanged and\nthe wire protocol is unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL\u003e0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:57.546Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d"
        },
        {
          "url": "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c"
        },
        {
          "url": "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812"
        },
        {
          "url": "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99"
        }
      ],
      "title": "scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63888",
    "datePublished": "2026-07-19T14:55:00.803Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:57.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3f4f82d1315f1439059a83d1c22c51a5b43d99e",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "3be2a24f7f72ad7321ed6ad1715b956a4527bcf4",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "0995d1f79aed8ccbf62056189dd53fd19726ea08",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "555702282d4536a865dfffb1cd4f6028f196e7e8",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "3b041514cb6eae45869b020f743c14d983363222",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.  But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings.  This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\n\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\n\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process\u0027s memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel\u0027s immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:37.398Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08"
        },
        {
          "url": "https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222"
        }
      ],
      "title": "memfd: deny writeable mappings when implying SEAL_WRITE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63952",
    "datePublished": "2026-07-19T14:55:44.809Z",
    "dateReserved": "2026-07-19T07:54:57.023Z",
    "dateUpdated": "2026-08-05T12:37:37.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a31b6d18ded3cc32d9ee85a6ff0726d4274887b2",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "595e6537ad1a210da32cbb9a7f91aa73090915ba",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "b2e26c955f8dd7e8d3f16c858db05245ea4fa817",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "6bc89f34a4597f9f6d41f7a60c67a3153bfe8851",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "423a78ff7928c2601013f73ec6d896f5597d0df5",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "75c93cd3c421890f49ea93f0b978b9b7bb10e5e3",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "7d29f7e9dbd844cae4d3e559cf78324b9642fd6b",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host\u0027s kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:22.293Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851"
        },
        {
          "url": "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5"
        },
        {
          "url": "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b"
        }
      ],
      "title": "RDMA/siw: bound Read Response placement to the RREAD length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64268",
    "datePublished": "2026-07-25T08:49:16.336Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-08-17T04:52:22.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "02bc2896bdc3e29362d6e40d404006944a159c25",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "3196b5192f246df4272072f61a2f4a3e9967f55d",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "14498ff5ce0f272ce0ef988721413e06b7038972",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "ff2d30927bc3bf3c629f0768d2068096e64ef5ce",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "b55e182f2324bc6a604c21a47aa6c448f719a532",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_open() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_open_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious SMB2/SMB3 server can trigger the flaw through network-delivered CREATE error responses after a victim mounts or accesses its share.\nAC:L - The server controls the replayable status and can disconnect or refuse reconnection so the next initialization fails; it can repeat the sequence to overcome scheduling variance.\nPR:N - The attacking server needs no account or privileges on the client, because the victim supplies the mounted SMB session and initiates the request.\nUI:R - A victim must mount the malicious share or perform an operation such as statfs, ACL access, notification, or file access that causes SMB2_open() to run.\nS:U - The double-free corrupts memory within the client kernel\u0027s existing security authority and does not inherently cross a VM or IOMMU boundary.\nC:H - The double-free can produce overlapping live SMB buffers and use-after-free access, supporting kernel-memory disclosure and arbitrary-read exploitation.\nI:H - Reallocation of the freed mempool object permits attacker-controlled network data to corrupt live kernel objects or allocator metadata, enabling arbitrary writes or control-flow hijacking.\nA:H - The double-free can immediately trigger allocator diagnostics or heap corruption leading to a kernel oops or panic, and the server can repeatedly retrigger it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:33.945Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/02bc2896bdc3e29362d6e40d404006944a159c25"
        },
        {
          "url": "https://git.kernel.org/stable/c/3196b5192f246df4272072f61a2f4a3e9967f55d"
        },
        {
          "url": "https://git.kernel.org/stable/c/14498ff5ce0f272ce0ef988721413e06b7038972"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff2d30927bc3bf3c629f0768d2068096e64ef5ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/b55e182f2324bc6a604c21a47aa6c448f719a532"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_open() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64382",
    "datePublished": "2026-07-25T08:50:31.937Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:33.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3409aedf3c81a810243da94164f6621c9d205c98",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "1665f25b1dea30bf2d02e16245d203a944c9d994",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "00b0fa425941438b664950a8ee65dfba2def4336",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "3317a5d015fca976475aa71df224056777316fde",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "9647492b5e41954be59d5157eddbcd4cdc1656f7",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query directory replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_directory_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:39.446Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98"
        },
        {
          "url": "https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994"
        },
        {
          "url": "https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336"
        },
        {
          "url": "https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde"
        },
        {
          "url": "https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7"
        }
      ],
      "title": "smb: client: fix query directory replay double-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64387",
    "datePublished": "2026-07-25T08:50:35.543Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:39.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "51144032248cc4ea22917370565650670b8b4e9b",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "277281c10c63791067d24d421f7c43a15faa9096",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n  Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n  Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n  Call Trace:\n    kasan_report+0x119/0x140\n    mutex_lock+0x76/0xe0\n    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n    adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n    process_one_work+0x6ac/0xfd0\n    worker_thread+0x4dd/0xd30\n    kthread+0x326/0x410\n    ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation originates from a local process or guest with direct access to an assigned QAT VF, using VF MMIO or the VF driver to generate VF2PF messages; it is not network-reachable.\nAC:L - The VF controls mailbox generation, restart-complete signaling, and acknowledgement behavior, and can keep response work active for up to one second while teardown proceeds. VF removal itself also emits shutdown traffic, making the race repeatedly attacker-alignable.\nPR:L - The attacker needs authorized access to an assigned QAT VF, which can be delegated through VFIO to an unprivileged process or tenant VM. No host administrative capability is required during management-initiated teardown or reset.\nUI:N - Exploitation requires no victim-user action; device teardown, hot-unplug, shutdown, or automatic error recovery supplies the concurrent lifecycle event.\nS:C - In a virtualized deployment, a tenant controlling an assigned VF corrupts memory in the host PF kernel, crossing the guest-to-host isolation boundary.\nC:H - The freed VF-state allocation contains kernel pointers and synchronization state, and reclamation of the stale object can support disclosure of arbitrary host-kernel memory.\nI:H - The worker performs writes through destroyed mutexes and stale pointers into freed or reallocated memory, providing memory-corruption primitives potentially usable for host-kernel code execution.\nA:H - The observed use-after-free produces invalid kernel writes and NULL-pointer dereferences, allowing a kernel oops or panic and complete host availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:39.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"
        },
        {
          "url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"
        }
      ],
      "title": "crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64438",
    "datePublished": "2026-07-25T08:51:11.740Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-17T04:55:39.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}