{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_phys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40f738991058eb3e3530c3006a5bd6fd5e29f035",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            },
            {
              "lessThan": "1ec8fc63e9cdb22da54e48e536c9204020416fc6",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            },
            {
              "lessThan": "14469860e2e39b7095dcd658d2bad38a11110a68",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            },
            {
              "lessThan": "07c33be968d9e0cab6cba38c81850a09942fcb2e",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            },
            {
              "lessThan": "3bd168dd835b93a3862cd05b0d13c432b115f9d6",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            },
            {
              "lessThan": "32d4c5d328a3ff995420f4f85163e1e403f43628",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            },
            {
              "lessThan": "dd51a2eeb93bc6faa892ff9083911dd23f82c187",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            },
            {
              "lessThan": "d21ad938398bca695a511307de38a65889e3b354",
              "status": "affected",
              "version": "c6790dc22312f592c1434577258b31c48c72d52a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_phys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local DRM/i915 ioctls, specifically GEM pread/pwrite on a phys-backed buffer object. It is not reachable from network, adjacent, or physical device input.\nAC:L - Once on an affected legacy i915 platform with a phys-backed cursor/overlay BO, a nonzero offset reliably triggers the bad scaled pointer arithmetic. There is no race or attacker-external timing condition.\nPR:L - The attacker needs local access to the DRM device and enough ordinary DRM/KMS access to create and pin a framebuffer-backed GEM object, but not real root or CAP_SYS_ADMIN. The pread/pwrite ioctls themselves are render-allowed.\nUI:N - No victim action is required after the attacker has local DRM access. The attacker can issue the needed ioctls directly.\nS:U - The vulnerability is a kernel memory access bug reachable from a kernel driver ioctl path. It does not cross a separate security authority such as a VM host boundary.\nC:H - The faulty phys BO pread path can copy out-of-bounds kernel memory back to userspace. This is a high confidentiality impact because it can disclose kernel memory beyond the intended buffer.\nI:H - The faulty phys BO pwrite path can copy attacker-controlled data out of bounds into kernel memory relative to the coherent allocation. This is kernel memory corruption and can plausibly be leveraged for privilege escalation.\nA:H - The out-of-bounds read/write can corrupt or access invalid kernel memory and cause an oops, panic, or hang. Repeated triggering is possible through local ioctls on the affected object."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:05.605Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68"
        },
        {
          "url": "https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187"
        },
        {
          "url": "https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354"
        }
      ],
      "title": "drm/i915/gem: Fix phys BO pread/pwrite with offset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53356",
    "datePublished": "2026-07-01T13:32:31.428Z",
    "dateReserved": "2026-06-09T07:44:35.400Z",
    "dateUpdated": "2026-08-05T12:35:05.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40df11255d71b02e20e70579f1b12b687e396e26",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "91fbb5e635c8fb1b49e15c19da06480089ef719f",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "8ae8b9e74bab94aab1d79f1688129bcc61c8b29a",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "b17175d0a375b3ed5e81597dac4983fdb46e478d",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "791941be5da125d9a1b228582bfdc300c05d05b3",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: zero-initialize GART table on allocation\n\nGART TLB is flushed after unmapping but not after mapping. Since\namdgpu_bo_create_kernel() does not zero-initialize the buffer, when a\nsingle PTE is written the TLB may speculatively load other uninitialized\nentries from the same cacheline. Those garbage entries can appear valid,\nand a subsequent write to another PTE in the same cacheline may cause the\nGPU to use a stale garbage PTE from the TLB.\n\nFix this by calling memset_io() to zero-initialize the GART table with\ngart_pte_flags immediately after allocation.\n\nUsing AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work\nsince SDMA needs GART to be initialized to work.\n\n(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached when a local process with access to /dev/dri/renderD* issues AMDGPU DRM ioctls (GEM_CREATE, CS) that bind GTT buffers through amdgpu_ttm_backend_bind() \u2192 amdgpu_gart_bind(), writing GART PTEs without a TLB flush. This is a local GPU driver ioctl path, not a network protocol.\nAC:L - An attacker with render-node access can reliably trigger GART PTE writes by allocating and binding GTT-domain buffers via standard ioctls; they control mapping timing and concurrency. Uninitialized VRAM contents at driver init are not an attacker-uncontrollable gate for triggering the stale-TLB condition.\nPR:L - All AMDGPU GEM/CS ioctls require DRM_AUTH|DRM_RENDER_ALLOW, which is satisfied by membership in the render/video group on typical desktop, workstation, and cloud-GPU instances\u2014not real root in the init namespace.\nUI:N - Exploitation requires only programmatic ioctl and GPU command submission; no victim interaction such as opening files or mounting filesystems is needed beyond the attacker already having render-node access.\nS:C - Stale garbage GART PTEs in the GPU TLB can cause the GPU to DMA to/from arbitrary physical pages outside the driver\u0027s intended mappings, bypassing the GART/IOMMU address-translation boundary that is supposed to confine GPU memory access.\nC:H - Speculatively loaded garbage PTEs that appear valid can redirect GPU reads to unintended physical memory, including kernel and other processes\u0027 pages, constituting arbitrary memory disclosure via rogue DMA.\nI:H - Those same stale valid PTEs can redirect GPU writes to arbitrary physical addresses, enabling arbitrary memory corruption and potential code execution through DMA write primitives.\nA:H - GPU DMA through invalid or garbage PTEs to unintended physical addresses can cause IOMMU faults, machine checks, GPU hangs, or kernel oops/panic, producing full system availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:18.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40df11255d71b02e20e70579f1b12b687e396e26"
        },
        {
          "url": "https://git.kernel.org/stable/c/91fbb5e635c8fb1b49e15c19da06480089ef719f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ae8b9e74bab94aab1d79f1688129bcc61c8b29a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b17175d0a375b3ed5e81597dac4983fdb46e478d"
        },
        {
          "url": "https://git.kernel.org/stable/c/791941be5da125d9a1b228582bfdc300c05d05b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741"
        }
      ],
      "title": "drm/amdgpu: zero-initialize GART table on allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53374",
    "datePublished": "2026-07-19T10:01:58.292Z",
    "dateReserved": "2026-06-09T07:44:35.401Z",
    "dateUpdated": "2026-08-05T12:35:18.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2fd24407457a6b181ba827705678da70e528dcd0",
              "status": "affected",
              "version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
              "versionType": "git"
            },
            {
              "lessThan": "962d684b5dc0741dcd93485d41b450de402d5592",
              "status": "affected",
              "version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix amdgpu_hmm_range_get_pages\n\nThe notifier sequence must only be read once or otherwise we could work\nwith invalid pages.\n\nWhile at it also fix the coding style, e.g. drop the pre-initialized\nreturn value and use the common define for 2G range.\n\n(cherry picked from commit c08972f555945cda57b0adb72272a37910153390)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a \u003e2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:49.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2fd24407457a6b181ba827705678da70e528dcd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/962d684b5dc0741dcd93485d41b450de402d5592"
        }
      ],
      "title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63879",
    "datePublished": "2026-07-19T14:54:51.698Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:49.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_ttm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "df73f3bc731af1c39ac5405bc59c4e7c6f8e9117",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "28b22dbaf407598cb3bb1d2c586a6f8018690ac2",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "073bcbc95e9648c976da1654c7590a8d6ee12c2d",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "c9ae7e7e3bc98615364313b08d7acea5239ded0b",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "a29654d451bbffe63d584a4cf64ad0efce6bcf1c",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "5c4063c87a619e4df954c179d24628636f5db15f",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_ttm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential UAF in TTM object purge\n\nTLDR: The bo-\u003ettm object might be changed by calling ttm_bo_validate(),\n      move casting it to an i915_tt object later to actually get the right\n      pointer.\n\nA user reported hitting the following bug under heavy use on DG2:\n\n[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI\n[26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy)\n[26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025\n[26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915]\n[26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 \u003c48\u003e 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78\n[26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282\n[26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000\n[26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff\n[26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000\n[26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0\n[26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0\n[26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000\n[26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0\n[26620.095612] PKRU: 55555554\n[26620.095612] Call Trace:\n[26620.095615] \u003cTASK\u003e\n[26620.095615] i915_ttm_move+0x2b9/0x420 [i915]\n[26620.095642] ? ttm_tt_init+0x65/0x80 [ttm]\n[26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915]\n[26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm]\n[26620.095669] ttm_bo_evict+0x100/0x150 [ttm]\n[26620.095671] ? preempt_count_add+0x64/0xa0\n[26620.095673] ? _raw_spin_lock+0xe/0x30\n[26620.095675] ? _raw_spin_unlock+0xd/0x30\n[26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915]\n[26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm]\n[26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm]\n[26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm]\n[26620.095709] ? init_object+0x62/0xd0\n[26620.095712] ttm_bo_validate+0x7a/0x180 [ttm]\n[26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915]\n[26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915]\n[26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095786] ? alloc_debug_processing+0xd0/0x100\n[26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915]\n[26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915]\n[26620.095848] i915_vma_pin_ww+0x706/0x980 [i915]\n[26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095904] eb_validate_vmas+0x170/0xa00 [i915]\n[26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915]\n[26620.095953] ? alloc_debug_processing+0xd0/0x100\n[26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.095977] ? __wake_up_sync_key+0x32/0x50\n[26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.096001] ? __slab_alloc.isra.0+0x67/0xc0\n[26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]\n\nResults from decode_stacktrace.sh pointed to dereference of a file pointer\nfield of a i915 TTM page vector container associated with an object being\npurged on eviction.  That path is taken when the object is marked as no\nlonger needed.\n\nCode analysis revealed a possibility of the i915 TTM page vector container\nbeing replaced with a new instance inside a function that purges content\nof the object, should it be still busy.  That function is called,\nindirectly via a more general function that changes the object\u0027s placement\nand caching policy,\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:53.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/df73f3bc731af1c39ac5405bc59c4e7c6f8e9117"
        },
        {
          "url": "https://git.kernel.org/stable/c/28b22dbaf407598cb3bb1d2c586a6f8018690ac2"
        },
        {
          "url": "https://git.kernel.org/stable/c/073bcbc95e9648c976da1654c7590a8d6ee12c2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9ae7e7e3bc98615364313b08d7acea5239ded0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a29654d451bbffe63d584a4cf64ad0efce6bcf1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c4063c87a619e4df954c179d24628636f5db15f"
        }
      ],
      "title": "drm/i915: Fix potential UAF in TTM object purge",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63884",
    "datePublished": "2026-07-19T14:54:57.520Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:53.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "edd06675a02376ea8347dba7c29ad982ba5b36ee",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "bf154c657828ed05399bca5d98cf1611bb048b12",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "4a3a19c98a8207ad08bec554703d90f2c34a8cc6",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "c04e85799356120209b351a148ac2db888d5ffd9",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "85db7391310b1304d2dc8ae3b0b12105a9567147",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Validate CHAP_R length before base64 decode\n\nchap_server_compute_hash() allocates client_digest as\nkzalloc(chap-\u003edigest_size) and then, for BASE64-encoded responses,\npasses chap_r directly to chap_base64_decode() without checking whether\nthe input length could produce more than digest_size bytes of output.\n\nchap_base64_decode() writes to the destination unconditionally as long\nas there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and\nthe \"0b\" prefix stripped by extract_param(), up to 127 base64 characters\ncan reach the decoder. 127 characters decode to 95 bytes. For SHA-256\n(digest_size=32) this overflows client_digest by 63 bytes; for MD5\n(digest_size=16) the overflow is 79 bytes.\n\nThe length check at line 344 fires after the write has already happened.\n\nThe HEX branch in the same switch statement already validates the length\nup front. Apply the same approach to the BASE64 branch: strip trailing\nbase64 padding characters, then reject any input whose data length\nexceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder.\n\nStripping trailing \u0027=\u0027 before the comparison handles both padded and\nunpadded encodings. chap_base64_decode() already returns early on \u0027=\u0027,\nso the full original string is still passed to the decoder unchanged.\n\nThe mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is\nkzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at\nCHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1\nbase64 characters reach the decoder. The maximum decoded size,\nDIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than\nCHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is\nadded at the call site to document this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:55.369Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/edd06675a02376ea8347dba7c29ad982ba5b36ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf154c657828ed05399bca5d98cf1611bb048b12"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a3a19c98a8207ad08bec554703d90f2c34a8cc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c04e85799356120209b351a148ac2db888d5ffd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/85db7391310b1304d2dc8ae3b0b12105a9567147"
        }
      ],
      "title": "scsi: target: iscsi: Validate CHAP_R length before base64 decode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63886",
    "datePublished": "2026-07-19T14:54:59.395Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:55.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7948af0dd03de84079dcd4dc215a69fd6fbb95d",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "badf178b76b0690851df00f4ca9cf2eb8eb0f963",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "6e22a1cdcc8277af4acc43710577157b77a02c5d",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "d3e9b79aa794f7a23e82de4d710e7d2df610e349",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "ec9f19d52074a191ed1756ed4a7d39fff1a2085c",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "5118ea225fe63b44207ba88047e4866e1ea43812",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "778c2ab142c625a8a8afa570e0f9b7873f445d99",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n\n1) DataDigest CRC buffer overread (4 bytes past text_in).\n\n   text_in is kzalloc()\u0027d at ALIGN(payload_length, 4).  rx_size is then\n   incremented by ISCSI_CRC_LEN to make room for the received DataDigest\n   in the iovec, but the same (now-bumped) rx_size is passed as the\n   buffer length to iscsit_crc_buf():\n\n       if (conn-\u003econn_ops-\u003eDataDigest) {\n               ...\n               rx_size += ISCSI_CRC_LEN;\n       }\n       ...\n       if (conn-\u003econn_ops-\u003eDataDigest) {\n               data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\n\n   iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\n   when DataDigest is negotiated it reads 4 bytes past the end of the\n   text_in allocation.  KASAN reproduces this directly on the unpatched\n   mainline tree as slab-out-of-bounds in crc32c() called from the Text\n   PDU path.  The OOB bytes feed crc32c() and are then compared against\n   the initiator-supplied checksum, so the value does not flow back to\n   the attacker, but the kernel does read past the buffer on every Text\n   PDU with DataDigest=CRC32C.\n\n   Fix by passing the actual padded payload length\n   (ALIGN(payload_length, 4)) that was used for the kzalloc().\n\n2) Stale cmd-\u003etext_in_ptr re-free (double-free) on ERL\u003e0 bad DataDigest\n   drop.\n\n   On DataDigest mismatch with ErrorRecoveryLevel \u003e 0 the handler\n   silently drops the PDU and lets the initiator plug the CmdSN gap:\n\n               kfree(text_in);\n               return 0;\n\n   cmd-\u003etext_in_ptr still points at the freed buffer.  The next Text\n   Request on the same ITT re-enters iscsit_setup_text_cmd(), which\n   unconditionally does\n\n       kfree(cmd-\u003etext_in_ptr);\n       cmd-\u003etext_in_ptr = NULL;\n\n   freeing the same pointer a second time.  Session teardown via\n   iscsit_release_cmd() has the same shape and hits the same double-free\n   if the connection is dropped before a second Text Request arrives.\n\n   On an unmodified mainline tree the bug-1 CRC overread fires first on\n   the initial valid Text Request and perturbs the subsequent state, so\n   #4 was isolated by building a kernel with only the bug-1 hunk of this\n   patch applied plus temporary printk() observability around the three\n   relevant kfree() sites.  The observability prints are not part of\n   this patch.  On that build, a three-PDU Text Request sequence after\n   login produces two back-to-back splats:\n\n       BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\n       BUG: KASAN: double-free in iscsit_release_cmd+0x??\n\n   showing the same pointer freed in the ERL\u003e0 drop path and again in\n   iscsit_setup_text_cmd() (next Text Request on the same ITT) and once\n   more in iscsit_release_cmd() (session teardown).  On distro kernels\n   with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\n   becomes a remote kernel BUG(); on non-hardened kernels it corrupts\n   the slab freelist.\n\n   Fix by clearing cmd-\u003etext_in_ptr after the kfree() in the ERL\u003e0 drop\n   path.  With both hunks applied #4 is directly observable on the stock\n   tree without observability printks; fixing bug-1 alone would mask #4\n   less, not more, so the hunks are submitted together.\n\nBoth fixes are one-liners.  The Text PDU state machine is unchanged and\nthe wire protocol is unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL\u003e0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:57.546Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d"
        },
        {
          "url": "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c"
        },
        {
          "url": "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812"
        },
        {
          "url": "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99"
        }
      ],
      "title": "scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63888",
    "datePublished": "2026-07-19T14:55:00.803Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:57.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3f4f82d1315f1439059a83d1c22c51a5b43d99e",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "3be2a24f7f72ad7321ed6ad1715b956a4527bcf4",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "0995d1f79aed8ccbf62056189dd53fd19726ea08",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "555702282d4536a865dfffb1cd4f6028f196e7e8",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            },
            {
              "lessThan": "3b041514cb6eae45869b020f743c14d983363222",
              "status": "affected",
              "version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.  But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings.  This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\n\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\n\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process\u0027s memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel\u0027s immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:37.398Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08"
        },
        {
          "url": "https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222"
        }
      ],
      "title": "memfd: deny writeable mappings when implying SEAL_WRITE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63952",
    "datePublished": "2026-07-19T14:55:44.809Z",
    "dateReserved": "2026-07-19T07:54:57.023Z",
    "dateUpdated": "2026-08-05T12:37:37.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23d8ea1e303b5f32d883757a4a707e791dbc9808",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "97e2d08de282ef76f84ab4ccd00f1acb3f5f999e",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "388468f7e7d1eab092cf2a39fdfb502e52019ec6",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "dc278e9bf2b9513a763353e6b9cc21e0f532954e",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e9c309ded295b7f8849097d71ae231456ca79f78",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b80056bd75a16e4550873ecefe12bc8fd190b1cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33cf52b6e53a6aa55883aa7fb9ceffceff8488a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b6075046470c8756242dfe3fd058813636f69a3",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in `blk_mq_submit_bio()`, reached from local block I/O submission (`submit_bio` via read/write, filesystem I/O, or io_uring). Reliable exploitation requires a `blk_plug` with populated `cached_rqs`, which occurs when io_uring submits batches of 3+ plugged read/write operations (`blk_start_plug_nr_ios`); remote-only paths like nfsd/ksmbd/nvmet typically use `blk_start_plug()` with `nr_ios=1` and do not populate the cached-request list needed to hit the peek-without-pop window.\nAC:L - An attacker controls both sides of the race by batching io_uring I/O and inducing a sleep between peek and pop (e.g., memory pressure during bio split/allocation, or `bio_integrity_prep()` blocking on PI-capable enterprise/cloud NVMe). Plug flush on any schedule is deterministic kernel behavior, not an uncontrollable environmental condition.\nPR:L - Triggering requires only an unprivileged local process able to perform block-backed I/O (normal file read/write or io_uring readv/writev to accessible storage); no root, `CAP_SYS_ADMIN`, or special kernel capabilities are needed beyond standard filesystem/device access available to any local user.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own I/O submissions through io_uring or direct block I/O; no action by another user or administrator is required.\nS:U - Impact is confined to kernel memory via a block-layer use-after-free on `struct request`; this is standard kernel privilege escalation territory and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a use-after-free of a `struct request` object; the attacker can influence post-free heap contents and dereference freed fields (`rq-\u003eq`, `rq-\u003emq_hctx`, `rq-\u003ebio`), enabling arbitrary kernel memory read primitives.\nI:H - UAF on `struct request` permits controlled writes through subsequent use of the dangling object (`rq-\u003ecmd_flags`, `queuelist`, bio attachment in `blk_mq_bio_to_request`), enabling heap corruption and potential arbitrary code execution in kernel context.\nA:H - The freed request is dereferenced during `blk_mq_use_cached_rq()` and subsequent request setup, causing kernel oops/panic; even without full exploitation, UAF reliably threatens system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:11.145Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808"
        },
        {
          "url": "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e"
        },
        {
          "url": "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"
        }
      ],
      "title": "blk-mq: pop cached request if it is usable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64017",
    "datePublished": "2026-07-19T15:39:11.989Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-19T16:28:11.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/core/dc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6590e3f766e3111dd1beaf88b9384d117acfa6b",
              "status": "affected",
              "version": "4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6",
              "versionType": "git"
            },
            {
              "lessThan": "16a5fa57565afb6bf37e18129921c270c93d8e2b",
              "status": "affected",
              "version": "4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6",
              "versionType": "git"
            },
            {
              "lessThan": "90c398e822ca76e40548df0c061dd4f93ea92d71",
              "status": "affected",
              "version": "4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6",
              "versionType": "git"
            },
            {
              "lessThan": "3265f3ed373fb8048be713aadcdf702579a0e53d",
              "status": "affected",
              "version": "4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6",
              "versionType": "git"
            },
            {
              "lessThan": "1ecde19bfce6535bffddad1139ff466b6d401b8e",
              "status": "affected",
              "version": "4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6",
              "versionType": "git"
            },
            {
              "lessThan": "1c8c6e912f2945b2a3e669afca6b52174b88e86e",
              "status": "affected",
              "version": "4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6",
              "versionType": "git"
            },
            {
              "lessThan": "6c92f6d9600efa3ef0d9e560a2b52776d9803c29",
              "status": "affected",
              "version": "4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/core/dc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n\n[Why\u0026How]\ndc_process_dmub_aux_transfer_async() copies payload-\u003elength bytes into a\n16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which\nis a no-op in release builds. If a caller ever passes length \u003e 16 this\nresults in a stack buffer overflow via memcpy.\n\nAdditionally, link_index is used to dereference dc-\u003elinks[] without\nbounds checking against dc-\u003elink_count, risking an out-of-bounds access.\n\nReplace the ASSERT with a hard runtime check that returns false when\npayload-\u003elength exceeds the destination buffer size, and add a bounds\ncheck for link_index before it is used.\n\n(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The closest attack surface is the local DRM DisplayPort AUX character-device path; no network protocol reaches this function. Physical USB4/DisplayPort devices can initiate AUX activity but cannot directly supply the vulnerable length or index.\nAC:H - All current callers cap transactions at 16 bytes, while link_index is derived from an internally created dc_link. Exploitation therefore requires an abnormal internal caller or corrupted state that the attacker cannot directly create.\nPR:L - Reaching the relevant DRM/AUX interfaces requires local device access, but the traced path contains no administrative capability or init-namespace privilege check. Basic session or device-ACL access is therefore sufficient.\nUI:N - Once the attacker has local device access and the required abnormal state exists, the vulnerable copy or dereference executes without further victim action.\nS:U - The corruption occurs within the host kernel and does not inherently cross a separate virtualization, IOMMU, or other security authority boundary.\nC:H - A length greater than 40 can copy payload-controlled bytes beyond the 64-byte stack command and overwrite control data. Successful control-flow hijacking would permit arbitrary kernel-memory disclosure.\nI:H - The unbounded stack write can overwrite saved state and potentially enable kernel code execution; an invalid link_index can also dereference a wild pointer. This supports complete integrity impact.\nA:H - FORTIFY converts a sufficiently large copy into a kernel panic, while unfortified stack corruption, stack-canary failure, or the unchecked link dereference can cause an oops or crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:07.374Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71"
        },
        {
          "url": "https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29"
        }
      ],
      "title": "drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64219",
    "datePublished": "2026-07-24T15:23:06.379Z",
    "dateReserved": "2026-07-19T15:36:31.770Z",
    "dateUpdated": "2026-08-05T12:40:07.374Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "ee2216dbdf0c677e89bb43e03247dba590ed00ef",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "f511807feee7cb29b61bdfa86472c7e9e2e5df94",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "08c600b7e1818539ba5efee4cdb06215c245ca78",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "c6c484a7d5bff6b929a86d7ed5130f29834c6a0d",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "f80add1bfb3425100a325b14f19648e75669a954",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "e3d9c7160d483fc8f9e225aafad8ecbbc43f3151",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: mask server-provided mode to 07777 in modefromsid\n\nWhen modefromsid is active, parse_dacl() applies the server-provided\nsub_auth[2] value from the NFS mode SID to cf_mode without masking to\n07777. Apply the correct masking, same as in the read path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB server can supply the crafted NFS mode SID through a network-delivered QUERY_INFO security descriptor.\nAC:L - With modefromsid enabled, the server directly controls sub_auth[2], and the invalid inode-type bits are applied deterministically without a race or memory-layout dependency.\nPR:N - The attacker acting as the SMB server needs no privileges on the client; client authentication to the share is a victim-side condition rather than an attacker privilege.\nUI:R - A victim administrator or service must mount the SMB share with modefromsid, or subsequently access a crafted object on an existing mount.\nS:U - The corrupted mode and resulting VFS behavior remain within the Linux kernel\u0027s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:N - The flaw only injects bits into the 16-bit mode field and provides no out-of-bounds read, memory disclosure, or direct mechanism for returning client data to the attacker.\nI:L - The attacker can alter S_IFMT bits in cf_mode and thereby change the inode\u0027s perceived type and selected VFS operations, but this is a constrained metadata modification rather than an arbitrary write or control-flow primitive.\nA:H - Forging the root or widespread inode types can prevent the share from mounting or render its objects unusable; for CIFS-root or critical SMB-backed deployments this can cause complete service availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:30.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94"
        },
        {
          "url": "https://git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78"
        },
        {
          "url": "https://git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f80add1bfb3425100a325b14f19648e75669a954"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151"
        }
      ],
      "title": "smb: client: mask server-provided mode to 07777 in modefromsid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64379",
    "datePublished": "2026-07-25T08:50:29.717Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:30.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}