{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbcon.c",
            "drivers/video/fbdev/core/fbmem.c",
            "include/linux/fbcon.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39c2c1a2773aaf73e56906e5ef670114eb2d354f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4ac18f0e6a6d599ca751c4cd98e522afc8e3d4eb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "468f78276a37f4c6499385a4ce28f4f57be6655d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c079d42f70109512eee49123a843be91d8fa133f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "de89d19f4f30d9a8de87b9d08c1bd35cb70576d8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a1f3058930745d2b938b6b4f5bd9630dc74b26b7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbcon.c",
            "drivers/video/fbdev/core/fbmem.c",
            "include/linux/fbcon.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Set fb_display[i]-\u003emode to NULL when the mode is released\n\nRecently, we discovered the following issue through syzkaller:\n\nBUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0\nRead of size 4 at addr ff11000001b3c69c by task syz.xxx\n...\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xab/0xe0\n print_address_description.constprop.0+0x2c/0x390\n print_report+0xb9/0x280\n kasan_report+0xb8/0xf0\n fb_mode_is_equal+0x285/0x2f0\n fbcon_mode_deleted+0x129/0x180\n fb_set_var+0xe7f/0x11d0\n do_fb_ioctl+0x6a0/0x750\n fb_ioctl+0xe0/0x140\n __x64_sys_ioctl+0x193/0x210\n do_syscall_64+0x5f/0x9c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nBased on experimentation and analysis, during framebuffer unregistration,\nonly the memory of fb_info-\u003emodelist is freed, without setting the\ncorresponding fb_display[i]-\u003emode to NULL for the freed modes. This leads\nto UAF issues during subsequent accesses. Here\u0027s an example of reproduction\nsteps:\n1. With /dev/fb0 already registered in the system, load a kernel module\n   to register a new device /dev/fb1;\n2. Set fb1\u0027s mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);\n3. Switch console from fb to VGA (to allow normal rmmod of the ko);\n4. Unload the kernel module, at this point fb1\u0027s modelist is freed, leaving\n   a wild pointer in fb_display[];\n5. Trigger the bug via system calls through fb0 attempting to delete a mode\n   from fb0.\n\nAdd a check in do_unregister_framebuffer(): if the mode to be freed exists\nin fb_display[], set the corresponding mode pointer to NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through `ioctl()` on the `/dev/fbN` character device (`FBIOPUT_VSCREENINFO` / `FBIOPUT_CON2FBMAP`), which requires local access to the system. There is no remote or network-facing path into fbcon.\nAC:L - Once a framebuffer has been unregistered leaving a stale `fb_display[i].mode`, triggering the use-after-free is a single deterministic ioctl with no race to win and no memory-layout condition outside the attacker\u0027s control. The attacker can additionally groom the freed `fb_modelist` slab with controlled allocations before dereferencing it.\nPR:L - No capability check exists anywhere in the fbdev ioctl path \u2014 access is governed solely by DAC on `/dev/fbN`, which logged-in seat users obtain via logind `uaccess` ACLs or `video`/`graphics` group membership on desktops, kiosks, embedded devices and Android. An unprivileged local user with a console/seat can issue every ioctl involved.\nUI:N - The attacker performs all steps himself via ioctls on the framebuffer device; no victim action is needed. The framebuffer unregistration that creates the stale pointer occurs through ordinary system events such as USB display/dock removal or DRM driver unbind.\nS:U - The corruption and its consequences are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The use-after-free reads a freed slab object that the attacker can reallocate with chosen or sensitive kernel data, and `display_to_var()`/`fb_videomode_to_var()` copy ~15 fields out of it into `info-\u003evar`, which is then readable from userspace via `FBIOGET_VSCREENINFO` \u2014 a repeatable kernel heap disclosure primitive.\nI:H - A use-after-free on a groomable kmalloc object permits heap spraying and type confusion with the reallocated victim object; the freed contents also propagate into `fb_check_var`/`fb_set_par` and console resize arithmetic, corrupting kernel state and enabling escalation to control-flow hijack.\nA:H - The reported syzkaller report is a KASAN slab-use-after-free that oopses the task in `fb_mode_is_equal()`; dereferencing the dangling pointer after the slab page is returned to the page allocator produces a kernel panic, and the stale pointer can be re-triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:36.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39c2c1a2773aaf73e56906e5ef670114eb2d354f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ac18f0e6a6d599ca751c4cd98e522afc8e3d4eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/468f78276a37f4c6499385a4ce28f4f57be6655d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c079d42f70109512eee49123a843be91d8fa133f"
        },
        {
          "url": "https://git.kernel.org/stable/c/de89d19f4f30d9a8de87b9d08c1bd35cb70576d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1f3058930745d2b938b6b4f5bd9630dc74b26b7"
        }
      ],
      "title": "fbcon: Set fb_display[i]-\u003emode to NULL when the mode is released",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40323",
    "datePublished": "2025-12-08T00:46:50.833Z",
    "dateReserved": "2025-04-16T07:20:57.186Z",
    "dateUpdated": "2026-08-05T12:09:36.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/common/smbdirect/smbdirect_socket.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e811e60e1cc79923c4388146eb1fa26a7482731e",
              "status": "affected",
              "version": "5fb9b459b3686e366640edd4e62805ef7b4de927",
              "versionType": "git"
            },
            {
              "lessThan": "f99996870222b598914a1f49d7375dc23752c237",
              "status": "affected",
              "version": "5fb9b459b3686e366640edd4e62805ef7b4de927",
              "versionType": "git"
            },
            {
              "lessThan": "6e3c5052f9686192e178806e017b7377155f4bab",
              "status": "affected",
              "version": "5fb9b459b3686e366640edd4e62805ef7b4de927",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/common/smbdirect/smbdirect_socket.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.11",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: smbdirect: introduce smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat\u0027s because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the \u0027recv_done\u0027 functions\nwe likely have a window where we grant credits, which\ndon\u0027t really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - SMBDirect is reached by a remote RDMA peer through RDMA CM listeners on SMBDirect/SMB ports such as 5445 and 445. The ksmbd server path processes the affected negotiation and data-transfer credit handling from network-originated RDMA messages.\nAC:L - The issue is a receive-credit accounting race, but the remote peer can repeatedly drive both message arrival and credit-request/response behavior with crafted SMBDirect traffic. No unusual victim state or uncontrollable condition is required beyond an enabled SMBDirect RDMA deployment.\nPR:N - The server-side path accepts the RDMA connection and performs SMBDirect negotiation and data-transfer credit handling before SMB session authentication. A remote peer does not need SMB credentials to reach the vulnerable credit logic.\nUI:N - Exploitation against the server path requires only network/RDMA traffic from the attacker. No local user or administrator action is needed after the service is exposed.\nS:U - The impact remains within the kernel SMBDirect/SMB service security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary crossing.\nC:N - The bug overgrants receive credits but does not expose a kernel read primitive; incoming payload bounds are checked before reassembly. An RDMA send without a posted receive should produce transport/RNR failure rather than disclose memory.\nI:N - The investigation did not identify an arbitrary write or memory-corruption primitive. The false credit causes receive-queue/transport state inconsistency, not attacker-controlled modification of kernel data.\nA:H - False credits can allow the peer to send when no real receive buffer is posted, causing RDMA QP/transport errors and SMBDirect disconnects with RNR retries disabled. Because this is remotely and unauthenticatedly repeatable against the exposed SMBDirect service, availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:24.146Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e811e60e1cc79923c4388146eb1fa26a7482731e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f99996870222b598914a1f49d7375dc23752c237"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e3c5052f9686192e178806e017b7377155f4bab"
        }
      ],
      "title": "smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31539",
    "datePublished": "2026-04-24T14:30:26.326Z",
    "dateReserved": "2026-03-09T15:48:24.114Z",
    "dateUpdated": "2026-08-05T12:23:24.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "88411caee8f576d6b5abf6531232fcc0ce756dc5",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "7688143ca62edeecacb3ba0a2cea129dbd262a18",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "63b51e8a9d54317d31cc3856c1e12407070d5fc2",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "3c817a60b09eaab926e475088e750936efcc95ae",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg\n\nCheck bounds against the end of the BO whenever we access the msg."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local DRM command-submission ioctl (DRM_IOCTL_AMDGPU_CS) on /dev/dri/renderD*; there is no network path to the GPU CS parser.\nAC:L - The attacker fully controls the decode-message contents (num_buffers, offset, size) and the BO size, so the out-of-bounds read is triggered deterministically with no race or uncontrolled condition.\nPR:L - The CS ioctl is DRM_RENDER_ALLOW, accessible to any unprivileged local user holding an fd to the render node; no root or special capability is required.\nUI:N - The attacker directly submits the crafted command buffer; no action by another user is needed.\nS:U - The OOB read is performed by the CPU within the kernel\u0027s own kmap of the BO; the impact stays within the kernel security authority with no IOMMU/VM boundary crossed.\nC:H - num_buffers and offset are attacker-controlled 32-bit values, producing an unbounded out-of-bounds read of kernel memory well beyond a few bytes, which per guidance is High.\nI:N - The flaw is purely an out-of-bounds read; no kernel memory is written or otherwise modified along the path.\nA:H - The unbounded OOB read into unmapped kernel memory triggers a page fault/oops, crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:24.038Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/88411caee8f576d6b5abf6531232fcc0ce756dc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7688143ca62edeecacb3ba0a2cea129dbd262a18"
        },
        {
          "url": "https://git.kernel.org/stable/c/63b51e8a9d54317d31cc3856c1e12407070d5fc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c817a60b09eaab926e475088e750936efcc95ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648"
        }
      ],
      "title": "drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46199",
    "datePublished": "2026-05-28T09:40:16.061Z",
    "dateReserved": "2026-05-13T15:03:33.104Z",
    "dateUpdated": "2026-08-05T12:30:24.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1dc005775fb5b3f86464406452b17364f85581d3",
              "status": "affected",
              "version": "0b15205c7325dc20b7da0068307670d222d66949",
              "versionType": "git"
            },
            {
              "lessThan": "d0802a8877d730260d4af4dd4e0b6cde7e0e593f",
              "status": "affected",
              "version": "0b15205c7325dc20b7da0068307670d222d66949",
              "versionType": "git"
            },
            {
              "lessThan": "a6d5563ba1f03a049561cd347574613167294e8d",
              "status": "affected",
              "version": "0b15205c7325dc20b7da0068307670d222d66949",
              "versionType": "git"
            },
            {
              "lessThan": "5c3e8ebad0c9e2354ddfa8f2148dc4f70a3b4bd1",
              "status": "affected",
              "version": "0b15205c7325dc20b7da0068307670d222d66949",
              "versionType": "git"
            },
            {
              "lessThan": "2444eb0ec8283f4a3845eb7febad378476e1ba3c",
              "status": "affected",
              "version": "0b15205c7325dc20b7da0068307670d222d66949",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn4: Prevent OOB reads when parsing IB\n\nRewrite the IB parsing to use amdgpu_ib_get_value() which handles the\nbounds checks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via the local amdgpu command-submission ioctl (DRM_IOCTL_AMDGPU_CS) on a DRM render node; no network or adjacent vector is involved.\nAC:L - The attacker fully controls the IB contents, length_dw, and the backing BO size/layout, so positioning the parser so that idx+6..+8 reads cross the BO\u0027s last mapped page is reliably reproducible.\nPR:L - Requires the ability to open the DRM render node and submit command buffers, i.e. an unprivileged local user with GPU/graphics-session access; no elevated capability is needed.\nUI:N - The malicious command buffer is submitted directly by the attacker; no action by another user is required.\nS:U - Parsing runs on the CPU in kernel context and the OOB access stays within the kernel\u0027s own memory; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked indexing reads kernel memory beyond the IB buffer object (decode_buffer fields and loop words), an out-of-bounds read of kernel memory that is not strictly limited to a couple of bytes.\nI:N - The flaw is purely an out-of-bounds read; the parser performs no OOB write and the OOB-derived address is re-validated before use, so no kernel data is modifiable.\nA:H - Reading past the BO into an unmapped kernel page faults during command submission, producing a kernel oops/crash that the attacker can trigger on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:26.200Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1dc005775fb5b3f86464406452b17364f85581d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0802a8877d730260d4af4dd4e0b6cde7e0e593f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d5563ba1f03a049561cd347574613167294e8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c3e8ebad0c9e2354ddfa8f2148dc4f70a3b4bd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2444eb0ec8283f4a3845eb7febad378476e1ba3c"
        }
      ],
      "title": "drm/amdgpu/vcn4: Prevent OOB reads when parsing IB",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46204",
    "datePublished": "2026-05-28T09:40:21.933Z",
    "dateReserved": "2026-05-13T15:03:33.104Z",
    "dateUpdated": "2026-08-05T12:30:26.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f55552adb100eb54a6e6dabff4fbdc8679bd3fa0",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "82c535eff05490c71153af57de9fe85502fcb5d5",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "638d3e0b9eb77aa53fdd60e2b928761d16ba76fa",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "870c8738c3774336baedddd0240951d078a703b8",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "638e48ee39d0f2af9336f917a6f5d6692dd64d93",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            },
            {
              "lessThan": "b193019860d61e92da395eae2011f2f6716b182f",
              "status": "affected",
              "version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg\n\nCheck bounds against the end of the BO whenever we access the msg."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via the local DRM_IOCTL_AMDGPU_CS ioctl on the GPU render node; the malicious message must be submitted by a local process holding a device fd, not over any network.\nAC:L - The attacker fully controls the message BO it allocates and references (length, num_buffers, offset/size), so it can deterministically set out-of-range values to trigger the OOB read with no race or uncontrolled condition.\nPR:L - The CS ioctl is DRM_RENDER_ALLOW, reachable by any unprivileged local user/sandboxed client with access to a render node; no root or special capability is required.\nUI:N - The attacker submits the crafted command stream directly; no victim action is needed.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - Attacker-controlled num_buffers and offset drive an unbounded out-of-bounds read of kernel memory well beyond a few bytes, which per guidance is treated as High confidentiality impact.\nI:N - The flaw is purely an out-of-bounds read; no out-of-range data is ever written back, so there is no memory-modification or control-flow-corruption primitive.\nA:H - Iterating over an attacker-supplied huge num_buffers reads past the kmapped buffer into unmapped memory, causing a kernel page fault/oops (crash)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:37.247Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f55552adb100eb54a6e6dabff4fbdc8679bd3fa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/82c535eff05490c71153af57de9fe85502fcb5d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/638d3e0b9eb77aa53fdd60e2b928761d16ba76fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/870c8738c3774336baedddd0240951d078a703b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/638e48ee39d0f2af9336f917a6f5d6692dd64d93"
        },
        {
          "url": "https://git.kernel.org/stable/c/e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b193019860d61e92da395eae2011f2f6716b182f"
        }
      ],
      "title": "drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46230",
    "datePublished": "2026-05-28T09:40:52.696Z",
    "dateReserved": "2026-05-13T15:03:33.106Z",
    "dateUpdated": "2026-08-05T12:30:37.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/mes_userqueue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "336a9186f3a4b65bbd865d93936605ac8a1a3991",
              "status": "affected",
              "version": "5fb2f7fc21a3668e5794cc0d153641b9719713e1",
              "versionType": "git"
            },
            {
              "lessThan": "6da7b1242da4455b11c24ce667d1cab1a348c8ea",
              "status": "affected",
              "version": "5fb2f7fc21a3668e5794cc0d153641b9719713e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/mes_userqueue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/userq: fix access to stale wptr mapping\n\nUse drm_exec to take both locks i.e vm root bo and\nwptr_obj bo to access the mapping data properly.\n\nThis fixes the security issue of unmap the wptr_obj while\na queue creation is in progress and passing other\nbo at same address.\n\n(cherry picked from commit 1fc6c8ab45dbee096469c08c13f6099d57a52d6c)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local DRM ioctls (DRM_IOCTL_AMDGPU_USERQ and DRM_IOCTL_AMDGPU_GEM_VA) on an AMDGPU render node (/dev/dri/renderD*), not via any network-facing path.\nAC:L - An attacker controls both sides of the race by running concurrent threads that issue USERQ_CREATE and GEM_VA UNMAP/REPLACE on the same wptr VA; amdgpu_vm_bo_unmap proceeds even when userq_va_mapped is set, making the window reliably triggerable.\nPR:L - Exploitation requires only access to the AMDGPU render node (DRM_AUTH|DRM_RENDER_ALLOW), which is available to unprivileged local users in the render/video group, not real root in the init namespace.\nUI:N - No victim interaction is required; the attacker automates the race with concurrent ioctl calls from their own process.\nS:U - The vulnerability corrupts kernel driver state and can lead to standard local kernel privilege escalation; it does not cross a VM, sandbox, or IOMMU security boundary.\nC:H - Operating on a stale BO pointer without holding locks can cause use-after-free and use attacker-replaced mappings, enabling arbitrary kernel memory disclosure through freed-object reuse and GART mapping confusion.\nI:H - The stale BO can be pinned and mapped into GART while a different BO occupies the VA, letting GPU firmware track wptr at the wrong physical address and enabling kernel heap corruption via UAF on amdgpu_bo structures.\nA:H - Use-after-free on BO reservation/pinning can kernel-oops the system, and incorrect wptr GART setup can hang or reset the GPU during queue scheduling."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:10.882Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/336a9186f3a4b65bbd865d93936605ac8a1a3991"
        },
        {
          "url": "https://git.kernel.org/stable/c/6da7b1242da4455b11c24ce667d1cab1a348c8ea"
        }
      ],
      "title": "drm/amdgpu/userq: fix access to stale wptr mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46311",
    "datePublished": "2026-06-08T15:50:41.866Z",
    "dateReserved": "2026-05-13T15:03:33.111Z",
    "dateUpdated": "2026-08-05T12:31:10.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:39.822Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nf_queue.c",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "950d809f154dca04e5fbe5d3c8b9c5e44769cd57",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            },
            {
              "lessThan": "a698ac8ab2561cf575d2d9f34095032651dd952e",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            },
            {
              "lessThan": "19924bdd8a45ebc72a7b84c57fd63057d1dc75ac",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            },
            {
              "lessThan": "1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            },
            {
              "lessThan": "3823c27099cfe2482299065814adbaa771be9644",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            },
            {
              "lessThan": "15d464265120ab9818bd673af301deee09bedab2",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            },
            {
              "lessThan": "3fb0f5c0f64162a8c3f25616a4f1e340b921737f",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            },
            {
              "lessThan": "e196115ec330a18de415bdb9f5071aa9f08e53ce",
              "status": "affected",
              "version": "ac28634456867b23b95faccba7997a62ec430603",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nf_queue.c",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb-\u003edev while queued\n\nbr_pass_frame_up() rewrites skb-\u003edev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN packets. NFQUEUE only holds\nreferences on state.in/out and bridge physdevs, so a queued bridge\npacket can retain a freed bridge master in skb-\u003edev until reinjection.\n\nWhen the verdict is reinjected later, br_netif_receive_skb() re-enters\nthe receive path with skb-\u003edev still pointing at the freed bridge master,\ntriggering a use-after-free.\n\nStore skb-\u003edev in the queue entry, hold a reference on it for the queue\nlifetime, and use the saved device when dropping queued packets during\nNETDEV_DOWN handling."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb-\u003edev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:35.846Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57"
        },
        {
          "url": "https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e"
        },
        {
          "url": "https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be"
        },
        {
          "url": "https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644"
        },
        {
          "url": "https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce"
        }
      ],
      "title": "netfilter: nf_queue: hold bridge skb-\u003edev while queued",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52912",
    "datePublished": "2026-06-24T07:14:10.583Z",
    "dateReserved": "2026-06-09T07:44:35.366Z",
    "dateUpdated": "2026-09-08T08:49:39.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `accel/ivpu` component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability or denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:44:29.981Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53203"
          },
          {
            "name": "RHBZ#2492798",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492798"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53203.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_ms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3c12ed33e8923f3090909a1738f3e59292996a6",
              "status": "affected",
              "version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
              "versionType": "git"
            },
            {
              "lessThan": "fa598556ecef412edcb391f144b7642e18fdfd45",
              "status": "affected",
              "version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
              "versionType": "git"
            },
            {
              "lessThan": "4e5047cc94bea1cc7b670b7f503358e9af0542df",
              "status": "affected",
              "version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
              "versionType": "git"
            },
            {
              "lessThan": "fb176425837693f50c5c9fc8db6fbb04af22bd0a",
              "status": "affected",
              "version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_ms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Add buffer overflow check in MS get_info_ioctl\n\nAdd validation that the info size returned from the metric stream info\nquery is not exceeded when checked against the allocated buffer size.\nIf the firmware returns a size larger than the buffer, reject the\noperation with -EOVERFLOW instead of proceeding with an incorrect\nbuffer copy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is a DRM accel ioctl on the local `/dev/accel/accel*` device, reached through `DRM_IOCTL_IVPU_METRIC_STREAMER_GET_INFO`. It is not reachable over the network or by adjacent/physical input.\nAC:L - The attacker controls the ioctl arguments, including the metric group mask and user buffer size, and there is no race or hard-to-win timing condition. Triggering the overlong copy depends on normal firmware response data for selected metrics, not on conditions outside the attacker\u2019s control in the vulnerable path.\nPR:L - A local user with access to the accelerator device node can open the device and issue the ioctl; the driver ioctl has no capability, master, or root-only check. This does not require real root/admin privileges.\nUI:N - After the attacker has local access to the device node, exploitation is performed directly by issuing ioctls. No victim action such as opening a file or mounting a filesystem is required.\nS:U - The issue is within the kernel driver and impacts kernel-managed resources on the same system. It is not a VM escape, IOMMU boundary bypass, or cross-authority scope change.\nC:H - The firmware-reported `info_size` was used as the `copy_to_user()` length without verifying it fits in the fixed 64 KiB kernel buffer, enabling an out-of-bounds kernel read into userspace. Under the higher-severity rule, this is treated as high confidentiality impact because adjacent kernel memory may be disclosed.\nI:N - The vulnerable host-side operation is an overlong copy from kernel memory to userspace, and the fix prevents that incorrect buffer copy. No kernel write primitive or data modification path is evident from this bug.\nA:H - An overlong kernel-source copy can run past the mapped buffer into invalid or sensitive kernel virtual memory and may fault or destabilize the kernel. Under the required higher-severity rule, the plausible local DoS impact is scored high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:07.179Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3c12ed33e8923f3090909a1738f3e59292996a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa598556ecef412edcb391f144b7642e18fdfd45"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e5047cc94bea1cc7b670b7f503358e9af0542df"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb176425837693f50c5c9fc8db6fbb04af22bd0a"
        }
      ],
      "title": "accel/ivpu: Add buffer overflow check in MS get_info_ioctl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53203",
    "datePublished": "2026-06-25T08:39:10.950Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:07.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_eu_stall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bebce43f34b5feb8a760aa832eba81e0f8a38871",
              "status": "affected",
              "version": "9a0b11d4cf3b4324378c322b7043962e648681ed",
              "versionType": "git"
            },
            {
              "lessThan": "84f2bfbe6e38f8b9815ca00826e53b7f51420402",
              "status": "affected",
              "version": "9a0b11d4cf3b4324378c322b7043962e648681ed",
              "versionType": "git"
            },
            {
              "lessThan": "dc2d9842c67d883d3200ae33b9c3859dd9492408",
              "status": "affected",
              "version": "9a0b11d4cf3b4324378c322b7043962e648681ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_eu_stall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/eustall: Fix drm_dev_put called before stream disable in close\n\nIn xe_eu_stall_stream_close(), drm_dev_put() is called before the\nstream is disabled and its resources are freed. If this drops the\nlast reference, the device structures could be freed while the\nsubsequent cleanup code still accesses them, leading to a\nuse-after-free.\n\nFix this by moving drm_dev_put() after all device accesses are\ncomplete. This matches the ordering in xe_oa_release().\n\n(cherry picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable close handler is reached from local userspace through the Xe DRM render-node ioctl path that opens an EU stall observation stream fd, then close/release on that fd. It is not reachable from network or adjacent protocols.\nAC:L - Once an EU stall stream fd exists, the vulnerable cleanup ordering is exercised by closing that fd; there is no attacker-uncontrolled race to win in the close path itself. The final-reference lifetime condition is a normal DRM device lifetime state rather than a precise timing primitive.\nPR:L - The default `xe_observation_paranoid` gate requires `CAP_PERFMON` or `CAP_SYS_ADMIN`, but the driver explicitly provides a sysctl allowing non-privileged users to access observation data. Under the required most-severe reasonable deployment rule, a basic local user with render-node access can reach the stream open/close path.\nUI:N - No victim interaction is needed after the attacker can issue the ioctl and close the returned stream fd. The attacker drives the relevant userspace operations directly.\nS:U - The vulnerable code is in the host kernel DRM driver and impacts the same kernel security authority. There is no evidence of a VM, IOMMU, or separate security-scope boundary crossing.\nC:H - This is a use-after-free of DRM/Xe device-related structures before subsequent cleanup dereferences them. Per kernel CVSS guidance, UAF memory corruption is treated as capable of enabling high confidentiality impact through reclaimed-object control and memory disclosure primitives.\nI:H - The UAF occurs before hardware stream disable, buffer teardown, and stream free operations continue through freed object graphs. Per kernel CVSS guidance, such UAF memory corruption is treated as potentially enabling arbitrary write or control-flow compromise.\nA:H - At minimum, dereferencing freed device structures in the close path can cause a kernel oops or panic. UAFs in kernel cleanup paths are therefore high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:56.992Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bebce43f34b5feb8a760aa832eba81e0f8a38871"
        },
        {
          "url": "https://git.kernel.org/stable/c/84f2bfbe6e38f8b9815ca00826e53b7f51420402"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc2d9842c67d883d3200ae33b9c3859dd9492408"
        }
      ],
      "title": "drm/xe/eustall: Fix drm_dev_put called before stream disable in close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53290",
    "datePublished": "2026-06-26T19:40:50.073Z",
    "dateReserved": "2026-06-09T07:44:35.396Z",
    "dateUpdated": "2026-08-05T12:34:56.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_drv.h",
            "drivers/gpu/drm/virtio/virtgpu_gem.c",
            "drivers/gpu/drm/virtio/virtgpu_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c86077d512ee980cc91322211d35dbcd3175f64c",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "21ab64c77a30d56efc506c8fa2ad8959f8ce3d36",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "7930eee22cd3df61e85be8aa512032ab303b7167",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "8fadd01cf461fee5bb11506621339c548447e5c7",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "a2359a411b15f495d12cfda6a7db6855ebb7f90f",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "9af1b6e175c82daf4b423da339a722d8e67a735a",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_drv.h",
            "drivers/gpu/drm/virtio/virtgpu_gem.c",
            "drivers/gpu/drm/virtio/virtgpu_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use uninterruptible resv lock for plane updates\n\nvirtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock\nthe framebuffer BO\u0027s dma_resv via virtio_gpu_array_lock_resv() and\nignore its return value. The function can fail with -EINTR from\ndma_resv_lock_interruptible() (signal during lock wait) or with\n-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),\nleaving the resv lock not held. The queue path then walks the object\narray and calls dma_resv_add_fence(), which requires the lock held;\nwith lockdep enabled this trips dma_resv_assert_held():\n\n  WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840\n  Call Trace:\n   virtio_gpu_array_add_fence\n   virtio_gpu_queue_ctrl_sgs\n   virtio_gpu_queue_fenced_ctrl_buffer\n   virtio_gpu_cursor_plane_update\n   drm_atomic_helper_commit_planes\n   drm_atomic_helper_commit_tail\n   commit_tail\n   drm_atomic_helper_commit\n   drm_atomic_commit\n   drm_atomic_helper_update_plane\n   __setplane_atomic\n   drm_mode_cursor_universal\n   drm_mode_cursor_common\n   drm_mode_cursor_ioctl\n   drm_ioctl\n   __x64_sys_ioctl\n\nBeyond the WARN, mutating the dma_resv fence list without the lock\nraces with concurrent readers/writers and can corrupt the list.\n\nBoth call sites run inside the .atomic_update plane callback, which\nDRM atomic helpers do not allow to fail (by the time it runs, the\ncommit has been signed off to userspace and there is no clean\nrollback path). Moving the lock acquisition to .prepare_fb was\nrejected because the broader lock scope deadlocks against other BO\nlocking paths in the same atomic commit.\n\nIntroduce virtio_gpu_lock_one_resv_uninterruptible() that uses\ndma_resv_lock() instead of dma_resv_lock_interruptible(). This\neliminates the -EINTR failure mode -- the realistic syzbot trigger\n-- without extending the lock hold across the commit. The helper\nlocks a single BO and rejects nents \u003e 1 with -EINVAL; both fix\nsites lock exactly one BO.\n\nUse it from virtio_gpu_cursor_plane_update() and\nvirtio_gpu_resource_flush(); check the return value to handle the\nremaining -ENOMEM case from dma_resv_reserve_fences() by freeing\nthe objs and skipping the plane update for that frame. The\nframebuffer BOs touched here are not shared with other contexts\nand lock contention is expected to be brief, so the loss of\nsignal-interruptibility is acceptable.\n\nOther callers of virtio_gpu_array_lock_resv() (the ioctl paths)\ncontinue to use the interruptible variant.\n\nThe bug was reported by syzbot, triggered via fault injection\n(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the\n-ENOMEM branch in dma_resv_reserve_fences()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:12.587Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36"
        },
        {
          "url": "https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a"
        }
      ],
      "title": "drm/virtio: use uninterruptible resv lock for plane updates",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64098",
    "datePublished": "2026-07-19T15:40:04.264Z",
    "dateReserved": "2026-07-19T07:54:57.033Z",
    "dateUpdated": "2026-08-05T12:39:12.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}